Suspicious
Suspect

9314816a879c27ef508979cceee11927

PE Executable
|
MD5: 9314816a879c27ef508979cceee11927
|
Size: 11.78 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
 Hash Value
MD5
9314816a879c27ef508979cceee11927
Sha1
5499d03bc8f8cb903ef0072567c7feb4b0db43ff
Sha256
ce7d5da8353623bddcb18be540adb1ef47faf19099f50679c5b75d15f315ee6c
Sha384
b3768f2b2ff41a74e6bb3bcdd8fb59f5219c946b27916ab0ca0b45ef5d0d2b218c197c81cc108351d0154f5cce996f14
Sha512
7bdf105396f4051ea80f573237748683bd4b7872a3907ab7b7b1d207d1c8c4ba3e9d035129cf077b42d92946c36fab1e2404c82881512d0a839c9b920069cb90
SSDeep
192:dILkbd+t8XCctsXMciaowAiXR3v92JILH7lQ68Jz9XzLDURrJT7+0lt:OIovDcLiXREJub2rJxDUFJTy
TLSH
B8320A12678D823BC9EA4F7D9A7351404BF4B3031603EF55388DA20B6C6336E5A567F6

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
9314816a879c27ef508979cceee11927
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ILRepack.List
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Zyipids
Full Name

Zyipids
EntryPoint

System.Void Evodl.Yiiys::Main()
Scope Name

Zyipids
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Zyipids
Assembly Version

1.0.1735.6187
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

15
Main Method

System.Void Evodl.Yiiys::Main()
Main IL Instruction Count

42
Main IL

newobj System.Void Evodl.Bxhuju::.ctor() stloc.0 <null> newobj System.Void Evodl.Euwoiwbx::.ctor() stloc.1 <null> newobj System.Void Evodl.Mlwdq::.ctor() stloc.2 <null> newobj System.Void Evodl.Alhpnflaygt::.ctor() stloc.3 <null> ldloc.1 <null> ldloc.2 <null> ldloc.3 <null> newobj System.Void Evodl.Swwuoehlf::.ctor(Evodl.Euwoiwbx,Evodl.Mlwdq,Evodl.Alhpnflaygt) stloc.s V_4 ldloc.0 <null> ldloc.s V_4 ldftn System.Void Evodl.Swwuoehlf::Ocqbyvopd(System.Object,Evodl.Vtwrifbsc) newobj System.Void System.EventHandler`1<Evodl.Vtwrifbsc>::.ctor(System.Object,System.IntPtr) callvirt System.Void Evodl.Bxhuju::add_DownloadCompleted(System.EventHandler`1<Evodl.Vtwrifbsc>) ldloc.1 <null> ldloc.s V_4 ldftn System.Void Evodl.Swwuoehlf::Miyuzckw(System.Object,Evodl.Ecsupu) newobj System.Void System.EventHandler`1<Evodl.Ecsupu>::.ctor(System.Object,System.IntPtr) callvirt System.Void Evodl.Euwoiwbx::add_DecryptionCompleted(System.EventHandler`1<Evodl.Ecsupu>) ldloc.2 <null> ldloc.s V_4 ldftn System.Void Evodl.Swwuoehlf::Soccd(System.Object,Evodl.Hcckhe) newobj System.Void System.EventHandler`1<Evodl.Hcckhe>::.ctor(System.Object,System.IntPtr) callvirt System.Void Evodl.Mlwdq::add_LoadCompleted(System.EventHandler`1<Evodl.Hcckhe>) ldloc.3 <null> ldloc.s V_4 ldftn System.Void Evodl.Swwuoehlf::Eencwwrho(System.Object,Evodl.Qfuldero) newobj System.Void System.EventHandler`1<Evodl.Qfuldero>::.ctor(System.Object,System.IntPtr) callvirt System.Void Evodl.Alhpnflaygt::add_InvocationCompleted(System.EventHandler`1<Evodl.Qfuldero>) ldloc.0 <null> callvirt System.Void Evodl.Bxhuju::Xzesavgbh() leave.s IL_0082: ret ldloc.s V_4 brfalse.s IL_0081: endfinally ldloc.s V_4 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ret <null>
Module Name

Zyipids
Full Name

Zyipids
EntryPoint

System.Void Evodl.Yiiys::Main()
Scope Name

Zyipids
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Zyipids
Assembly Version

1.0.1735.6187
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

15
Main Method

System.Void Evodl.Yiiys::Main()
Main IL Instruction Count

42
Main IL

newobj System.Void Evodl.Bxhuju::.ctor() stloc.0 <null> newobj System.Void Evodl.Euwoiwbx::.ctor() stloc.1 <null> newobj System.Void Evodl.Mlwdq::.ctor() stloc.2 <null> newobj System.Void Evodl.Alhpnflaygt::.ctor() stloc.3 <null> ldloc.1 <null> ldloc.2 <null> ldloc.3 <null> newobj System.Void Evodl.Swwuoehlf::.ctor(Evodl.Euwoiwbx,Evodl.Mlwdq,Evodl.Alhpnflaygt) stloc.s V_4 ldloc.0 <null> ldloc.s V_4 ldftn System.Void Evodl.Swwuoehlf::Ocqbyvopd(System.Object,Evodl.Vtwrifbsc) newobj System.Void System.EventHandler`1<Evodl.Vtwrifbsc>::.ctor(System.Object,System.IntPtr) callvirt System.Void Evodl.Bxhuju::add_DownloadCompleted(System.EventHandler`1<Evodl.Vtwrifbsc>) ldloc.1 <null> ldloc.s V_4 ldftn System.Void Evodl.Swwuoehlf::Miyuzckw(System.Object,Evodl.Ecsupu) newobj System.Void System.EventHandler`1<Evodl.Ecsupu>::.ctor(System.Object,System.IntPtr) callvirt System.Void Evodl.Euwoiwbx::add_DecryptionCompleted(System.EventHandler`1<Evodl.Ecsupu>) ldloc.2 <null> ldloc.s V_4 ldftn System.Void Evodl.Swwuoehlf::Soccd(System.Object,Evodl.Hcckhe) newobj System.Void System.EventHandler`1<Evodl.Hcckhe>::.ctor(System.Object,System.IntPtr) callvirt System.Void Evodl.Mlwdq::add_LoadCompleted(System.EventHandler`1<Evodl.Hcckhe>) ldloc.3 <null> ldloc.s V_4 ldftn System.Void Evodl.Swwuoehlf::Eencwwrho(System.Object,Evodl.Qfuldero) newobj System.Void System.EventHandler`1<Evodl.Qfuldero>::.ctor(System.Object,System.IntPtr) callvirt System.Void Evodl.Alhpnflaygt::add_InvocationCompleted(System.EventHandler`1<Evodl.Qfuldero>) ldloc.0 <null> callvirt System.Void Evodl.Bxhuju::Xzesavgbh() leave.s IL_0082: ret ldloc.s V_4 brfalse.s IL_0081: endfinally ldloc.s V_4 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ret <null>
9314816a879c27ef508979cceee11927 (11.78 KB)
File Structure
9314816a879c27ef508979cceee11927
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ILRepack.List
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙