Suspicious
Suspect

PE Executable
MD5: 6ca21b5b6fabcc30ee6c1b9ac79e26f2
Size: 870.4 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
MD5 6ca21b5b6fabcc30ee6c1b9ac79e26f2
Sha1 63a3719846956a894cb5070022c298f53dcf9afa
Sha256 2ce0358958dec9420addee948555ce5fd0810e9b6054c6a9d5b472e93501e582
Sha384 1fdc0b13073709f34da10a67cc78a5efa135365cd40b3d01ffd632245ff26f06ac7b1ea5a2409614e3cc4b481e58d833
Sha512 e23d4ab398c4c1d82c813346746e554789ab60e8a85850d037b182598c148ce01c8f267c695d8f21f1b30256311e1efca7bf6a007b87fd0cafcd42bb33a4fbc1
SSDeep 12288:8wbT2qCKqOZQ8rmCGdYV7gLqBkAI+TOF7uZFAvjv+ztB7Gmmazyzz5SPRYEnb:p2sRQA9GdYV7gLikAVaF7XjCU
TLSH 6805CF9C3254B59EC413CD728974ED70AA207D6AA70BC20395D72E9FB91DA96DF002F3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
6ca21b5b6fabcc30ee6c1b9ac79e26f2
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
EventLogAnalyzer.Forms.MainForm.resources
EventLogAnalyzer.Properties.Resources.resources
IO
[NBF]root.Data
PxkT
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
nYcn.exe
Full Name
nYcn.exe
EntryPoint
System.Void EventLogAnalyzer.Program::Main()
Scope Name
nYcn.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
nYcn
Assembly Version
3.7.2.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
341
Main Method
System.Void EventLogAnalyzer.Program::Main()
Main IL Instruction Count
96
Main IL 
nop <null>
ldc.i4 -91471697
ldc.i4 -1376127003
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0051: nop
call System.Void EventLogAnalyzer.Program::‌‮​​‪‎‎‌‬​​‎‬‍‬​‬‭‏‮‌‌‍‭‮()
ldloc.1 <null>
ldc.i4 -2042086394
mul <null>
ldc.i4 464629996
xor <null>
br.s IL_0006: ldc.i4 -1376127003
nop <null>
ldc.i4.0 <null>
call System.Void EventLogAnalyzer.Program::‪‮‭‫‍‭‎‏‪‬‭‫‍​‬‏‫‏​‫‬‌‌​‭‪‌‭‮(System.Boolean)
ldloc.1 <null>
ldc.i4 -938882806
mul <null>
ldc.i4 -1886100976
xor <null>
br.s IL_0006: ldc.i4 -1376127003
nop <null>
nop <null>
ldc.i4 -1636831670
ldc.i4 -1376127003
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.5 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00B6: leave.s IL_0124
newobj System.Void EventLogAnalyzer.Forms.MainForm::.ctor()
call System.Void EventLogAnalyzer.Program::‎‏‏‫‌‪‌‬‬‭‭​‌​‌‏‭‌‍‍‪‬‫‮‍‏‭‌‮(System.Windows.Forms.Form)
ldloc.1 <null>
ldc.i4 -2129533286
mul <null>
ldc.i4 2115018288
xor <null>
br.s IL_0058: ldc.i4 -1376127003
nop <null>
ldloc.1 <null>
ldc.i4 1990170880
mul <null>
ldc.i4 -1500576870
xor <null>
br.s IL_0058: ldc.i4 -1376127003
nop <null>
ldloc.1 <null>
ldc.i4 -1924015413
mul <null>
ldc.i4 -1157609357
xor <null>
br.s IL_0058: ldc.i4 -1376127003
leave.s IL_0124: ret
stloc.0 <null>
ldc.i4 -797367529
ldc.i4 -1376127003
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0121: nop
nop <null>
ldloc.1 <null>
ldc.i4 -1709546675
mul <null>
ldc.i4 659808056
xor <null>
br.s IL_00BE: ldc.i4 -1376127003
ldstr An unexpected error occurred:


ldloc.0 <null>
call System.String EventLogAnalyzer.Program::‌‏‍‮‬‮‎‮‭‭‭‬‪‌‏‌‌​‎‌‭‬‮‫‮(System.Exception)
ldstr 

The application will now close.
call System.String EventLogAnalyzer.Program::‎‪‫‍‍‬‪‎‏‮‮‫‏‮‭‭‍​‎‌‫‎‬‫‮‏‏‫‮(System.String,System.String,System.String)
ldstr Critical Error
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult EventLogAnalyzer.Program::‫​‮‬‪‭​‫‏‮​‎‬‪‫‪‏‭‫‏‪‏‍​​‪‌‮(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
ldloc.1 <null>
ldc.i4 608201917
mul <null>
ldc.i4 -2113198225
xor <null>
br.s IL_00BE: ldc.i4 -1376127003
nop <null>
leave.s IL_0124: ret
ret <null>
Module Name
nYcn.exe
Full Name
nYcn.exe
EntryPoint
System.Void EventLogAnalyzer.Program::Main()
Scope Name
nYcn.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
nYcn
Assembly Version
3.7.2.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
341
Main Method
System.Void EventLogAnalyzer.Program::Main()
Main IL Instruction Count
96
Main IL 
nop <null>
ldc.i4 -91471697
ldc.i4 -1376127003
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0051: nop
call System.Void EventLogAnalyzer.Program::‌‮​​‪‎‎‌‬​​‎‬‍‬​‬‭‏‮‌‌‍‭‮()
ldloc.1 <null>
ldc.i4 -2042086394
mul <null>
ldc.i4 464629996
xor <null>
br.s IL_0006: ldc.i4 -1376127003
nop <null>
ldc.i4.0 <null>
call System.Void EventLogAnalyzer.Program::‪‮‭‫‍‭‎‏‪‬‭‫‍​‬‏‫‏​‫‬‌‌​‭‪‌‭‮(System.Boolean)
ldloc.1 <null>
ldc.i4 -938882806
mul <null>
ldc.i4 -1886100976
xor <null>
br.s IL_0006: ldc.i4 -1376127003
nop <null>
nop <null>
ldc.i4 -1636831670
ldc.i4 -1376127003
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.5 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00B6: leave.s IL_0124
newobj System.Void EventLogAnalyzer.Forms.MainForm::.ctor()
call System.Void EventLogAnalyzer.Program::‎‏‏‫‌‪‌‬‬‭‭​‌​‌‏‭‌‍‍‪‬‫‮‍‏‭‌‮(System.Windows.Forms.Form)
ldloc.1 <null>
ldc.i4 -2129533286
mul <null>
ldc.i4 2115018288
xor <null>
br.s IL_0058: ldc.i4 -1376127003
nop <null>
ldloc.1 <null>
ldc.i4 1990170880
mul <null>
ldc.i4 -1500576870
xor <null>
br.s IL_0058: ldc.i4 -1376127003
nop <null>
ldloc.1 <null>
ldc.i4 -1924015413
mul <null>
ldc.i4 -1157609357
xor <null>
br.s IL_0058: ldc.i4 -1376127003
leave.s IL_0124: ret
stloc.0 <null>
ldc.i4 -797367529
ldc.i4 -1376127003
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0121: nop
nop <null>
ldloc.1 <null>
ldc.i4 -1709546675
mul <null>
ldc.i4 659808056
xor <null>
br.s IL_00BE: ldc.i4 -1376127003
ldstr An unexpected error occurred:


ldloc.0 <null>
call System.String EventLogAnalyzer.Program::‌‏‍‮‬‮‎‮‭‭‭‬‪‌‏‌‌​‎‌‭‬‮‫‮(System.Exception)
ldstr 

The application will now close.
call System.String EventLogAnalyzer.Program::‎‪‫‍‍‬‪‎‏‮‮‫‏‮‭‭‍​‎‌‫‎‬‫‮‏‏‫‮(System.String,System.String,System.String)
ldstr Critical Error
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult EventLogAnalyzer.Program::‫​‮‬‪‭​‫‏‮​‎‬‪‫‪‏‭‫‏‪‏‍​​‪‌‮(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
ldloc.1 <null>
ldc.i4 608201917
mul <null>
ldc.i4 -2113198225
xor <null>
br.s IL_00BE: ldc.i4 -1376127003
nop <null>
leave.s IL_0124: ret
ret <null>
6ca21b5b6fabcc30ee6c1b9ac79e26f2
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
EventLogAnalyzer.Forms.MainForm.resources
EventLogAnalyzer.Properties.Resources.resources
IO
[NBF]root.Data
PxkT
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙