Malicious
Malicious

5b2ed9c729b4a0915bda302c023e0478

Share on LinkedIn
Print
PE Executable
MD5: 5b2ed9c729b4a0915bda302c023e0478
Size: 828.93 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 5b2ed9c729b4a0915bda302c023e0478
Sha1 ed7dfb9642ae2a0b9f6331e8a75bbd10e25a76a2
Sha256 8b18c11fe95bd59dd8e018d75668792c478e557a71a54a7f078f2ef4f060ab0c
Sha384 f75eaa61bb3b241228e8c575561954a47e42397271feee1031770c84781816ce7cd5b2e95bc365c2c08323618d1abe7f
Sha512 a7b0301ba08dc999fa40cd2f990a2edf0cde5f59c465078881313a5d5efa196ef8fd9376554158e2687bdc6c5c19a4362305b989beb5166b71596afa74e180cb
SSDeep 12288:5sv7AsftroSqMOhkyqo3ssDLAqbfqGBT+x/xEivXaH:5KfFcSua7oXb9BTC/bvKH
TLSH E805BF3A72918F21D24A1373C1DB4A0097EA9A577697FB0B71C413D71D423FEEA0A687
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
5b2ed9c729b4a0915bda302c023e0478
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
0XmSblkOS95IJ25VJK.rHAVoXS9LDXw2ZXkrP
WiqRvMCLS0yeCa7iZh.t95NMghu2N4ylNmKZf
GnR4dLc6altWcTdWoX.TO1BQ042vUXFQqFHgy
hxhvnY0OlF5YpDRsTm.PdlFqZT7jjGlQAPrkT
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Pynyw.exe
Full Name
Pynyw.exe
EntryPoint
System.Void FbLWkMvBbyUn7SdjF3.H2V7DKdBse5myZNOAY::yQ0yHq7cP()
Scope Name
Pynyw.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Pynyw
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void FbLWkMvBbyUn7SdjF3.H2V7DKdBse5myZNOAY::yQ0yHq7cP()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0062: nop
ret <null>
ldsfld ePwciwdkavkfP4Q4yRl ePwciwdkavkfP4Q4yRl::W2JdS8jRWo
call System.Void ePwciwdkavkfP4Q4yRl::YyddXyCbtL(ePwciwdkavkfP4Q4yRl)
ldc.i4 1
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_070e1ebc078f4a618db62b33468d58c4
brtrue IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
nop <null>
ldsfld t9WbQedCyU2eAYN9s9g t9WbQedCyU2eAYN9s9g::SjCdhu8Uh5
call System.Byte[] t9WbQedCyU2eAYN9s9g::YyddXyCbtL(t9WbQedCyU2eAYN9s9g)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_eb089ae93f5d40bdba7b40d2c7915bbc
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 2129152185
ldc.i4 2129152185
ldc.i4 735969310
xor <null>
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_8229f2e819714fb692fbf5196169f328
xor <null>
ldsfld nesHWxddyKX655uDiGI nesHWxddyKX655uDiGI::DdZdvkQ1VJ
call System.String nesHWxddyKX655uDiGI::YyddXyCbtL(System.Int32,nesHWxddyKX655uDiGI)
ldc.i4 -1348219289
ldc.i4 1252643138
sub <null>
ldc.i4 1398607248
xor <null>
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_3bba49adcfac4d728443cd0ee6004fd8
xor <null>
ldsfld nesHWxddyKX655uDiGI nesHWxddyKX655uDiGI::DdZdvkQ1VJ
call System.String nesHWxddyKX655uDiGI::YyddXyCbtL(System.Int32,nesHWxddyKX655uDiGI)
newobj System.Void dkqGlE0jougD671ypK9.Y7nwo10XKUIkV8yQumI::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld XkjjZAdyhZ0wrwNpyJ1 XkjjZAdyhZ0wrwNpyJ1::q0ddeKeXML
call dkqGlE0jougD671ypK9.Y7nwo10XKUIkV8yQumI XkjjZAdyhZ0wrwNpyJ1::YyddXyCbtL(System.Object,System.Byte[],XkjjZAdyhZ0wrwNpyJ1)
ldsfld LRnQyGd9UQGkuk3EroM LRnQyGd9UQGkuk3EroM::jW1dsTI5sT
call dkqGlE0jougD671ypK9.Y7nwo10XKUIkV8yQumI LRnQyGd9UQGkuk3EroM::YyddXyCbtL(System.Object,LRnQyGd9UQGkuk3EroM)
ldsfld mPJd1LdHXHwObPyKS5B mPJd1LdHXHwObPyKS5B::pdvdMY4V6O
call System.Void mPJd1LdHXHwObPyKS5B::YyddXyCbtL(System.Object,mPJd1LdHXHwObPyKS5B)
ldc.i4 1
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_ca8d645b6dd94428beeeba068a4829a1
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 4
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_29e7db5bd1c84d47bdb27ec548692c58
brtrue IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_017D: ldloc V_3
br IL_019D: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_27df84d58748457bb607dfb210a5b3f5
brtrue IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
Module Name
Pynyw.exe
Full Name
Pynyw.exe
EntryPoint
System.Void FbLWkMvBbyUn7SdjF3.H2V7DKdBse5myZNOAY::yQ0yHq7cP()
Scope Name
Pynyw.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Pynyw
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void FbLWkMvBbyUn7SdjF3.H2V7DKdBse5myZNOAY::yQ0yHq7cP()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0062: nop
ret <null>
ldsfld ePwciwdkavkfP4Q4yRl ePwciwdkavkfP4Q4yRl::W2JdS8jRWo
call System.Void ePwciwdkavkfP4Q4yRl::YyddXyCbtL(ePwciwdkavkfP4Q4yRl)
ldc.i4 1
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_070e1ebc078f4a618db62b33468d58c4
brtrue IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
nop <null>
ldsfld t9WbQedCyU2eAYN9s9g t9WbQedCyU2eAYN9s9g::SjCdhu8Uh5
call System.Byte[] t9WbQedCyU2eAYN9s9g::YyddXyCbtL(t9WbQedCyU2eAYN9s9g)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_eb089ae93f5d40bdba7b40d2c7915bbc
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 2129152185
ldc.i4 2129152185
ldc.i4 735969310
xor <null>
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_8229f2e819714fb692fbf5196169f328
xor <null>
ldsfld nesHWxddyKX655uDiGI nesHWxddyKX655uDiGI::DdZdvkQ1VJ
call System.String nesHWxddyKX655uDiGI::YyddXyCbtL(System.Int32,nesHWxddyKX655uDiGI)
ldc.i4 -1348219289
ldc.i4 1252643138
sub <null>
ldc.i4 1398607248
xor <null>
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_3bba49adcfac4d728443cd0ee6004fd8
xor <null>
ldsfld nesHWxddyKX655uDiGI nesHWxddyKX655uDiGI::DdZdvkQ1VJ
call System.String nesHWxddyKX655uDiGI::YyddXyCbtL(System.Int32,nesHWxddyKX655uDiGI)
newobj System.Void dkqGlE0jougD671ypK9.Y7nwo10XKUIkV8yQumI::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld XkjjZAdyhZ0wrwNpyJ1 XkjjZAdyhZ0wrwNpyJ1::q0ddeKeXML
call dkqGlE0jougD671ypK9.Y7nwo10XKUIkV8yQumI XkjjZAdyhZ0wrwNpyJ1::YyddXyCbtL(System.Object,System.Byte[],XkjjZAdyhZ0wrwNpyJ1)
ldsfld LRnQyGd9UQGkuk3EroM LRnQyGd9UQGkuk3EroM::jW1dsTI5sT
call dkqGlE0jougD671ypK9.Y7nwo10XKUIkV8yQumI LRnQyGd9UQGkuk3EroM::YyddXyCbtL(System.Object,LRnQyGd9UQGkuk3EroM)
ldsfld mPJd1LdHXHwObPyKS5B mPJd1LdHXHwObPyKS5B::pdvdMY4V6O
call System.Void mPJd1LdHXHwObPyKS5B::YyddXyCbtL(System.Object,mPJd1LdHXHwObPyKS5B)
ldc.i4 1
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_ca8d645b6dd94428beeeba068a4829a1
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 4
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_29e7db5bd1c84d47bdb27ec548692c58
brtrue IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_017D: ldloc V_3
br IL_019D: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59} <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_96337f791c854092b27da27f41a7c4f5
ldfld System.Int32 <Module>{dc8d1b60-eea2-441a-aaa3-bfe4fb205c59}::m_27df84d58748457bb607dfb210a5b3f5
brtrue IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙