Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 5 files
EXE81fe73d80003837a06f91f6d34d99e8c
Structure
Name Value
Module Name
Teygd.exe
Full Name
Teygd.exe
EntryPoint
System.Void Teygd.Dwlyiwfaiun::Main()
Scope Name
Teygd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Teygd
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void Teygd.Dwlyiwfaiun::Main()
Main IL Instruction Count
103
Main IL 
ldc.i4 4
stloc V_2
br IL_000E: ldloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
br IL_01DB: br IL_0038
nop <null>
ldc.i4 2
br IL_0012: switch(IL_01DB,IL_0038,IL_009E,IL_0067,IL_0043,IL_01B4,IL_008B)
call System.Void dOAS76rdcoVfAHUAvun.ynjN1rrBQq6ggMygyCD::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 2
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_11875d717aaf43a98e19dc696d80bab1
brfalse IL_0012: switch(IL_01DB,IL_0038,IL_009E,IL_0067,IL_0043,IL_01B4,IL_008B)
pop <null>
ldc.i4 3
br IL_0012: switch(IL_01DB,IL_0038,IL_009E,IL_0067,IL_0043,IL_01B4,IL_008B)
br IL_01B5: newobj System.Void Teygd.Gcbqlivcjoe::.ctor()
ldc.i4 1
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_caca2802adc6419d90e69698feba5912
brfalse IL_0012: switch(IL_01DB,IL_0038,IL_009E,IL_0067,IL_0043,IL_01B4,IL_008B)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_01DB,IL_0038,IL_009E,IL_0067,IL_0043,IL_01B4,IL_008B)
br IL_01B4: ret
ldc.i4 5
stloc V_2
br IL_000E: ldloc V_2
nop <null>
ldloc.s V_1
call System.Byte[] Teygd.Properties.Ihwpv::get_Myhiunz()
ldsfld System.Object fpRMG3PmGoDwqSBYf4.r1FHmm5tohFhRnV5fJ::DpjYojuWe
ldsfld System.Object fpRMG3PmGoDwqSBYf4.r1FHmm5tohFhRnV5fJ::yyrvVQERX
ldc.i4 -1999015886
ldc.i4 -666106558
xor <null>
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_8f6b18d4f4204d5d90000f49badc5ce7
xor <null>
call System.String zlbb20KBxvr8dMr2jyy.rhRFPLKqT6NK3vC5gsw::SLTK1ogvwu(System.Int32)
ldc.i4 -2135523249
neg <null>
ldc.i4 1732408045
xor <null>
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_e014df2d3bd24012a8c5b326d07b5858
xor <null>
call System.String zlbb20KBxvr8dMr2jyy.rhRFPLKqT6NK3vC5gsw::SLTK1ogvwu(System.Int32)
ldnull <null>
callvirt System.Void Teygd.Gcbqlivcjoe::Fwafq(System.Byte[],System.Byte[],System.Byte[],System.String,System.String,System.Object[])
ldc.i4 0
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_cd2fcd186dcf45f6bafc36458d489af4
brtrue IL_0110: switch(IL_0122,IL_0146)
pop <null>
ldc.i4 0
br IL_0110: switch(IL_0122,IL_0146)
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0122: br IL_0146
br IL_0146: leave IL_01B4
ldc.i4 1
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_ceb952b8ec2444acacba276cab1b710a
brtrue IL_0110: switch(IL_0122,IL_0146)
pop <null>
ldc.i4 1
br IL_0110: switch(IL_0122,IL_0146)
leave IL_01B4: ret
pop <null>
ldc.i4 0
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_fa0e0590e986475aa880791081c504b3
brtrue IL_016F: switch(IL_0181,IL_01A5)
pop <null>
ldc.i4 0
br IL_016F: switch(IL_0181,IL_01A5)
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_0181: br IL_01A5
br IL_01A5: leave IL_01B4
ldc.i4 0
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_61635242eec6434594b2ee418d8c4fb9
brtrue IL_016F: switch(IL_0181,IL_01A5)
pop <null>
ldc.i4 1
br IL_016F: switch(IL_0181,IL_01A5)
leave IL_01B4: ret
ldc.i4 6
br IL_0012: switch(IL_01DB,IL_0038,IL_009E,IL_0067,IL_0043,IL_01B4,IL_008B)
ret <null>
newobj System.Void Teygd.Gcbqlivcjoe::.ctor()
stloc.s V_1
ldc.i4 0
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_78b04ac820c4430eb6bb7e9c832c6ff2
brtrue IL_0012: switch(IL_01DB,IL_0038,IL_009E,IL_0067,IL_0043,IL_01B4,IL_008B)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_01DB,IL_0038,IL_009E,IL_0067,IL_0043,IL_01B4,IL_008B)
br IL_0038: nop
Module Name
Teygd.exe
Full Name
Teygd.exe
EntryPoint
System.Void Teygd.Dwlyiwfaiun::Main()
Scope Name
Teygd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Teygd
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void Teygd.Dwlyiwfaiun::Main()
Main IL Instruction Count
103
Main IL 
ldc.i4 4
stloc V_2
br IL_000E: ldloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
br IL_01DB: br IL_0038
nop <null>
ldc.i4 2
br IL_0012: switch(IL_01DB,IL_0038,IL_009E,IL_0067,IL_0043,IL_01B4,IL_008B)
call System.Void dOAS76rdcoVfAHUAvun.ynjN1rrBQq6ggMygyCD::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 2
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_11875d717aaf43a98e19dc696d80bab1
brfalse IL_0012: switch(IL_01DB,IL_0038,IL_009E,IL_0067,IL_0043,IL_01B4,IL_008B)
pop <null>
ldc.i4 3
br IL_0012: switch(IL_01DB,IL_0038,IL_009E,IL_0067,IL_0043,IL_01B4,IL_008B)
br IL_01B5: newobj System.Void Teygd.Gcbqlivcjoe::.ctor()
ldc.i4 1
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_caca2802adc6419d90e69698feba5912
brfalse IL_0012: switch(IL_01DB,IL_0038,IL_009E,IL_0067,IL_0043,IL_01B4,IL_008B)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_01DB,IL_0038,IL_009E,IL_0067,IL_0043,IL_01B4,IL_008B)
br IL_01B4: ret
ldc.i4 5
stloc V_2
br IL_000E: ldloc V_2
nop <null>
ldloc.s V_1
call System.Byte[] Teygd.Properties.Ihwpv::get_Myhiunz()
ldsfld System.Object fpRMG3PmGoDwqSBYf4.r1FHmm5tohFhRnV5fJ::DpjYojuWe
ldsfld System.Object fpRMG3PmGoDwqSBYf4.r1FHmm5tohFhRnV5fJ::yyrvVQERX
ldc.i4 -1999015886
ldc.i4 -666106558
xor <null>
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_8f6b18d4f4204d5d90000f49badc5ce7
xor <null>
call System.String zlbb20KBxvr8dMr2jyy.rhRFPLKqT6NK3vC5gsw::SLTK1ogvwu(System.Int32)
ldc.i4 -2135523249
neg <null>
ldc.i4 1732408045
xor <null>
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_e014df2d3bd24012a8c5b326d07b5858
xor <null>
call System.String zlbb20KBxvr8dMr2jyy.rhRFPLKqT6NK3vC5gsw::SLTK1ogvwu(System.Int32)
ldnull <null>
callvirt System.Void Teygd.Gcbqlivcjoe::Fwafq(System.Byte[],System.Byte[],System.Byte[],System.String,System.String,System.Object[])
ldc.i4 0
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_cd2fcd186dcf45f6bafc36458d489af4
brtrue IL_0110: switch(IL_0122,IL_0146)
pop <null>
ldc.i4 0
br IL_0110: switch(IL_0122,IL_0146)
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0122: br IL_0146
br IL_0146: leave IL_01B4
ldc.i4 1
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_ceb952b8ec2444acacba276cab1b710a
brtrue IL_0110: switch(IL_0122,IL_0146)
pop <null>
ldc.i4 1
br IL_0110: switch(IL_0122,IL_0146)
leave IL_01B4: ret
pop <null>
ldc.i4 0
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_fa0e0590e986475aa880791081c504b3
brtrue IL_016F: switch(IL_0181,IL_01A5)
pop <null>
ldc.i4 0
br IL_016F: switch(IL_0181,IL_01A5)
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_0181: br IL_01A5
br IL_01A5: leave IL_01B4
ldc.i4 0
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_61635242eec6434594b2ee418d8c4fb9
brtrue IL_016F: switch(IL_0181,IL_01A5)
pop <null>
ldc.i4 1
br IL_016F: switch(IL_0181,IL_01A5)
leave IL_01B4: ret
ldc.i4 6
br IL_0012: switch(IL_01DB,IL_0038,IL_009E,IL_0067,IL_0043,IL_01B4,IL_008B)
ret <null>
newobj System.Void Teygd.Gcbqlivcjoe::.ctor()
stloc.s V_1
ldc.i4 0
ldsfld <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605} <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_600212ba2a464675bdf09be7c1cd5b44
ldfld System.Int32 <Module>{a2c81149-592f-4fdc-b3f1-2b0c1292d605}::m_78b04ac820c4430eb6bb7e9c832c6ff2
brtrue IL_0012: switch(IL_01DB,IL_0038,IL_009E,IL_0067,IL_0043,IL_01B4,IL_008B)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_01DB,IL_0038,IL_009E,IL_0067,IL_0043,IL_01B4,IL_008B)
br IL_0038: nop
An error has occurred. This application may no longer respond until reloaded. Reload 🗙