Malicious PE Executable analysis – 95ed5604e996

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

1.46 MB · 1,461,760 B

First seen

2026-10-19 07:00 · 6 days ago

Last seen

2026-10-19 07:00 · 6 days ago

Last analysis

2026-10-19 08:17 · 6 days ago

Hashes

MD5 07e93d6b568ad1b99bd2b0c7cde108c5 Sha1 022d3c1660114e78cf55c3fe974c6716e0d041e4 Sha256 95ed5604e996c5d69a1a279a93788e2ee4121f96229e4297b4e609e40612f11e Sha384 c254a2f155891476f02c5b7f22c742e7d497bf03fdb7f55a6144774fd4a869a46c4985998f194f38e8300083673765a7 Sha512 74a09401712cf7276f0da9d621b4602790f5e88b6b97064cd590ff11772e5c74285139db37d19288ee642aca211ebc31aedef80166bf5bb140849561c2bffdc0 SSDeep 24576:A7QZdQb/32q1SEDx/KKLJqA6GU9SYq4+DpQEAIBcE0w:CDd9x/1qA6Z9Xq1pNiEt TLSH 8E651228675ADD03C5B6073145E0F27013F59D89F522E28B8FE97DDB3A22BC91CC8692

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon

Symbol obfuscation

Medium

1 malicious · 16 files

EXE07e93d6b568ad1b99bd2b0c7cde108c5

Structure

BINResources

BIN.Net Resources

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	IYFD.exe
Full Name	IYFD.exe
EntryPoint	System.Void ze.bY::CZ()
Scope Name	IYFD.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	IYFD
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	417
Main Method	System.Void ze.bY::CZ()
Main IL Instruction Count	16
Main IL	br IL_0011: nop nop <null> ret <null> call System.Void V6T.K63::cgr() br IL_001C: nop nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_002C: nop nop <null> newobj System.Void hRa.WR4::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0005: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0007: call System.Void V6T.K63::cgr()
Module Name	IYFD.exe
Full Name	IYFD.exe
EntryPoint	System.Void ze.bY::CZ()
Scope Name	IYFD.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	IYFD
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	417
Main Method	System.Void ze.bY::CZ()
Main IL Instruction Count	16
Main IL	br IL_0011: nop nop <null> ret <null> call System.Void V6T.K63::cgr() br IL_001C: nop nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_002C: nop nop <null> newobj System.Void hRa.WR4::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0005: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0007: call System.Void V6T.K63::cgr()