Malicious
Malicious

5b2ed9c729b4a0915bda302c023e0478

PE Executable
MD5: 5b2ed9c729b4a0915bda302c023e0478
Size: 828.93 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 5b2ed9c729b4a0915bda302c023e0478
Sha1 ed7dfb9642ae2a0b9f6331e8a75bbd10e25a76a2
Sha256 8b18c11fe95bd59dd8e018d75668792c478e557a71a54a7f078f2ef4f060ab0c
Sha384 f75eaa61bb3b241228e8c575561954a47e42397271feee1031770c84781816ce7cd5b2e95bc365c2c08323618d1abe7f
Sha512 a7b0301ba08dc999fa40cd2f990a2edf0cde5f59c465078881313a5d5efa196ef8fd9376554158e2687bdc6c5c19a4362305b989beb5166b71596afa74e180cb
SSDeep 12288:5sv7AsftroSqMOhkyqo3ssDLAqbfqGBT+x/xEivXaH:5KfFcSua7oXb9BTC/bvKH
TLSH E805BF3A72918F21D24A1373C1DB4A0097EA9A577697FB0B71C413D71D423FEEA0A687
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
5b2ed9c729b4a0915bda302c023e0478
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
0XmSblkOS95IJ25VJK.rHAVoXS9LDXw2ZXkrP
WiqRvMCLS0yeCa7iZh.t95NMghu2N4ylNmKZf
GnR4dLc6altWcTdWoX.TO1BQ042vUXFQqFHgy
hxhvnY0OlF5YpDRsTm.PdlFqZT7jjGlQAPrkT
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Pynyw.exe
Full Name
Pynyw.exe
EntryPoint
System.Void FbLWkMvBbyUn7SdjF3.H2V7DKdBse5myZNOAY::yQ0yHq7cP()
Scope Name
Pynyw.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Pynyw
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void FbLWkMvBbyUn7SdjF3.H2V7DKdBse5myZNOAY::yQ0yHq7cP()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0062: nop
ret <null>
ldsfld ePwciwdkavkfP4Q4yRl ePwciwdkavkfP4Q4yRl::W2JdS8jRWo
call System.Void ePwciwdkavkfP4Q4yRl::YyddXyCbtL(ePwciwdkavkfP4Q4yRl)
ldc.i4 1
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_070e1ebc078f4a618db62b33468d58c4
brtrue IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
nop <null>
ldsfld t9WbQedCyU2eAYN9s9g t9WbQedCyU2eAYN9s9g::SjCdhu8Uh5
call System.Byte[] t9WbQedCyU2eAYN9s9g::YyddXyCbtL(t9WbQedCyU2eAYN9s9g)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_eb089ae93f5d40bdba7b40d2c7915bbc
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 2129152185
ldc.i4 2129152185
ldc.i4 735969310
xor <null>
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_8229f2e819714fb692fbf5196169f328
xor <null>
ldsfld nesHWxddyKX655uDiGI nesHWxddyKX655uDiGI::DdZdvkQ1VJ
call System.String nesHWxddyKX655uDiGI::YyddXyCbtL(System.Int32,nesHWxddyKX655uDiGI)
ldc.i4 -1348219289
ldc.i4 1252643138
sub <null>
ldc.i4 1398607248
xor <null>
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_3bba49adcfac4d728443cd0ee6004fd8
xor <null>
ldsfld nesHWxddyKX655uDiGI nesHWxddyKX655uDiGI::DdZdvkQ1VJ
call System.String nesHWxddyKX655uDiGI::YyddXyCbtL(System.Int32,nesHWxddyKX655uDiGI)
newobj System.Void dkqGlE0jougD671ypK9.Y7nwo10XKUIkV8yQumI::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld XkjjZAdyhZ0wrwNpyJ1 XkjjZAdyhZ0wrwNpyJ1::q0ddeKeXML
call dkqGlE0jougD671ypK9.Y7nwo10XKUIkV8yQumI XkjjZAdyhZ0wrwNpyJ1::YyddXyCbtL(System.Object,System.Byte[],XkjjZAdyhZ0wrwNpyJ1)
ldsfld LRnQyGd9UQGkuk3EroM LRnQyGd9UQGkuk3EroM::jW1dsTI5sT
call dkqGlE0jougD671ypK9.Y7nwo10XKUIkV8yQumI LRnQyGd9UQGkuk3EroM::YyddXyCbtL(System.Object,LRnQyGd9UQGkuk3EroM)
ldsfld mPJd1LdHXHwObPyKS5B mPJd1LdHXHwObPyKS5B::pdvdMY4V6O
call System.Void mPJd1LdHXHwObPyKS5B::YyddXyCbtL(System.Object,mPJd1LdHXHwObPyKS5B)
ldc.i4 1
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_ca8d645b6dd94428beeeba068a4829a1
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 4
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_29e7db5bd1c84d47bdb27ec548692c58
brtrue IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_017D: ldloc V_3
br IL_019D: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_27df84d58748457bb607dfb210a5b3f5
brtrue IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
Module Name
Pynyw.exe
Full Name
Pynyw.exe
EntryPoint
System.Void FbLWkMvBbyUn7SdjF3.H2V7DKdBse5myZNOAY::yQ0yHq7cP()
Scope Name
Pynyw.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Pynyw
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void FbLWkMvBbyUn7SdjF3.H2V7DKdBse5myZNOAY::yQ0yHq7cP()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0062: nop
ret <null>
ldsfld ePwciwdkavkfP4Q4yRl ePwciwdkavkfP4Q4yRl::W2JdS8jRWo
call System.Void ePwciwdkavkfP4Q4yRl::YyddXyCbtL(ePwciwdkavkfP4Q4yRl)
ldc.i4 1
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_070e1ebc078f4a618db62b33468d58c4
brtrue IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
nop <null>
ldsfld t9WbQedCyU2eAYN9s9g t9WbQedCyU2eAYN9s9g::SjCdhu8Uh5
call System.Byte[] t9WbQedCyU2eAYN9s9g::YyddXyCbtL(t9WbQedCyU2eAYN9s9g)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_eb089ae93f5d40bdba7b40d2c7915bbc
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 2129152185
ldc.i4 2129152185
ldc.i4 735969310
xor <null>
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_8229f2e819714fb692fbf5196169f328
xor <null>
ldsfld nesHWxddyKX655uDiGI nesHWxddyKX655uDiGI::DdZdvkQ1VJ
call System.String nesHWxddyKX655uDiGI::YyddXyCbtL(System.Int32,nesHWxddyKX655uDiGI)
ldc.i4 -1348219289
ldc.i4 1252643138
sub <null>
ldc.i4 1398607248
xor <null>
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_3bba49adcfac4d728443cd0ee6004fd8
xor <null>
ldsfld nesHWxddyKX655uDiGI nesHWxddyKX655uDiGI::DdZdvkQ1VJ
call System.String nesHWxddyKX655uDiGI::YyddXyCbtL(System.Int32,nesHWxddyKX655uDiGI)
newobj System.Void dkqGlE0jougD671ypK9.Y7nwo10XKUIkV8yQumI::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld XkjjZAdyhZ0wrwNpyJ1 XkjjZAdyhZ0wrwNpyJ1::q0ddeKeXML
call dkqGlE0jougD671ypK9.Y7nwo10XKUIkV8yQumI XkjjZAdyhZ0wrwNpyJ1::YyddXyCbtL(System.Object,System.Byte[],XkjjZAdyhZ0wrwNpyJ1)
ldsfld LRnQyGd9UQGkuk3EroM LRnQyGd9UQGkuk3EroM::jW1dsTI5sT
call dkqGlE0jougD671ypK9.Y7nwo10XKUIkV8yQumI LRnQyGd9UQGkuk3EroM::YyddXyCbtL(System.Object,LRnQyGd9UQGkuk3EroM)
ldsfld mPJd1LdHXHwObPyKS5B mPJd1LdHXHwObPyKS5B::pdvdMY4V6O
call System.Void mPJd1LdHXHwObPyKS5B::YyddXyCbtL(System.Object,mPJd1LdHXHwObPyKS5B)
ldc.i4 1
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_ca8d645b6dd94428beeeba068a4829a1
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 4
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_29e7db5bd1c84d47bdb27ec548692c58
brtrue IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_017D: ldloc V_3
br IL_019D: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_27df84d58748457bb607dfb210a5b3f5
brtrue IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
5b2ed9c729b4a0915bda302c023e0478
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
0XmSblkOS95IJ25VJK.rHAVoXS9LDXw2ZXkrP
WiqRvMCLS0yeCa7iZh.t95NMghu2N4ylNmKZf
GnR4dLc6altWcTdWoX.TO1BQ042vUXFQqFHgy
hxhvnY0OlF5YpDRsTm.PdlFqZT7jjGlQAPrkT
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙