Suspicious
Suspect

9e76617f3bb207e3bbdb2df9528d33ee

PE Executable
MD5: 9e76617f3bb207e3bbdb2df9528d33ee
Size: 936.96 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
MD5 9e76617f3bb207e3bbdb2df9528d33ee
Sha1 a75af01ba4d6bc0b5df3ca2de97b12a639346abf
Sha256 c9e434249c8233d35e8bb5a03cdd049a100ed54ecb6d1080b25b3aabcc73f2e5
Sha384 233fbfa5d0bfb1b7032c323a3f95fa094236f422cd90772a40be99e2bfe2347dbb02bf41ca027a8f16479504c84fc651
Sha512 8de7985c8890e867319a5f3b679177af321be725d0cf07ff90599972eacfd368fb79616a7b3fe1124287217050beb29a1642e075ca540bfa23d04e2e9a09b15f
SSDeep 24576:uI9RQUMGw1r4eEFPF03tySt4r8IWiH57N:uk/BRN4t7IW85
TLSH 4C15AD983D03A5BEC413C97E9A70DC739A1C6C6A920FC20355D73E6FB83D5569A3C1A2
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
9e76617f3bb207e3bbdb2df9528d33ee
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
EventLogAnalyzer.Forms.MainForm.resources
EventLogAnalyzer.Properties.Resources.resources
IO
[NBF]root.Data
mcYR
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
eXVG.exe
Full Name
eXVG.exe
EntryPoint
System.Void EventLogAnalyzer.Program::Main()
Scope Name
eXVG.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
eXVG
Assembly Version
3.7.2.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
341
Main Method
System.Void EventLogAnalyzer.Program::Main()
Main IL Instruction Count
90
Main IL 
nop <null>
ldc.i4 -755994702
ldc.i4 -685651977
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.5 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0064: nop
call System.Void EventLogAnalyzer.Program::‏​‮‎‭‎‏‏‍‍‬‮‍‫‮‭​‏‪‏‭‬‎‭​‮()
ldloc.1 <null>
ldc.i4 -2119395441
mul <null>
ldc.i4 1999480850
xor <null>
br.s IL_0006: ldc.i4 -685651977
nop <null>
ldloc.1 <null>
ldc.i4 -868256354
mul <null>
ldc.i4 940877296
xor <null>
br.s IL_0006: ldc.i4 -685651977
ldc.i4.0 <null>
call System.Void EventLogAnalyzer.Program::‎‎‏​‎‏‏‭‭‬‭‭‬‎​‍‎‬‏‏‫‌‍‎‎‫‎‮(System.Boolean)
ldloc.1 <null>
ldc.i4 -1158453438
mul <null>
ldc.i4 -1760162586
xor <null>
br.s IL_0006: ldc.i4 -685651977
nop <null>
nop <null>
ldc.i4 -1330400355
ldc.i4 -685651977
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00B6: leave.s IL_0111
newobj System.Void EventLogAnalyzer.Forms.MainForm::.ctor()
call System.Void EventLogAnalyzer.Program::‎‎‎‌‌‬‍‎‎‬​‪​‎‬‮‭​‪‪‍‮‎‌‭‌‮(System.Windows.Forms.Form)
nop <null>
ldloc.1 <null>
ldc.i4 759893066
mul <null>
ldc.i4 2070396250
xor <null>
br.s IL_006B: ldc.i4 -685651977
nop <null>
ldloc.1 <null>
ldc.i4 1421343892
mul <null>
ldc.i4 919346759
xor <null>
br.s IL_006B: ldc.i4 -685651977
leave.s IL_0111: ret
stloc.0 <null>
nop <null>
ldstr An unexpected error occurred:


ldloc.0 <null>
call System.String EventLogAnalyzer.Program::‏‍‍‍‮‮‎‪‬‬‎‍‮‬‏‮‬‎‮‌‎‪‮‍​‫‮(System.Exception)
ldstr 

The application will now close.
call System.String EventLogAnalyzer.Program::‫‭‬‪‮‏‏‬​‮‪‫‏‎‫‬‮‪‍‎‮‪‪‎‪‭‏‌‮(System.String,System.String,System.String)
ldstr Critical Error
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult EventLogAnalyzer.Program::​‬‭‎‮‮​‏‮‪‌‏‌‭‍‪‎‪‍‮(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
ldc.i4 -1828270323
ldc.i4 -685651977
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.3 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_010F: leave.s IL_0111
nop <null>
ldloc.1 <null>
ldc.i4 1071812520
mul <null>
ldc.i4 1667231319
xor <null>
br.s IL_00E2: ldc.i4 -685651977
leave.s IL_0111: ret
ret <null>
Module Name
eXVG.exe
Full Name
eXVG.exe
EntryPoint
System.Void EventLogAnalyzer.Program::Main()
Scope Name
eXVG.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
eXVG
Assembly Version
3.7.2.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
341
Main Method
System.Void EventLogAnalyzer.Program::Main()
Main IL Instruction Count
90
Main IL 
nop <null>
ldc.i4 -755994702
ldc.i4 -685651977
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.5 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0064: nop
call System.Void EventLogAnalyzer.Program::‏​‮‎‭‎‏‏‍‍‬‮‍‫‮‭​‏‪‏‭‬‎‭​‮()
ldloc.1 <null>
ldc.i4 -2119395441
mul <null>
ldc.i4 1999480850
xor <null>
br.s IL_0006: ldc.i4 -685651977
nop <null>
ldloc.1 <null>
ldc.i4 -868256354
mul <null>
ldc.i4 940877296
xor <null>
br.s IL_0006: ldc.i4 -685651977
ldc.i4.0 <null>
call System.Void EventLogAnalyzer.Program::‎‎‏​‎‏‏‭‭‬‭‭‬‎​‍‎‬‏‏‫‌‍‎‎‫‎‮(System.Boolean)
ldloc.1 <null>
ldc.i4 -1158453438
mul <null>
ldc.i4 -1760162586
xor <null>
br.s IL_0006: ldc.i4 -685651977
nop <null>
nop <null>
ldc.i4 -1330400355
ldc.i4 -685651977
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00B6: leave.s IL_0111
newobj System.Void EventLogAnalyzer.Forms.MainForm::.ctor()
call System.Void EventLogAnalyzer.Program::‎‎‎‌‌‬‍‎‎‬​‪​‎‬‮‭​‪‪‍‮‎‌‭‌‮(System.Windows.Forms.Form)
nop <null>
ldloc.1 <null>
ldc.i4 759893066
mul <null>
ldc.i4 2070396250
xor <null>
br.s IL_006B: ldc.i4 -685651977
nop <null>
ldloc.1 <null>
ldc.i4 1421343892
mul <null>
ldc.i4 919346759
xor <null>
br.s IL_006B: ldc.i4 -685651977
leave.s IL_0111: ret
stloc.0 <null>
nop <null>
ldstr An unexpected error occurred:


ldloc.0 <null>
call System.String EventLogAnalyzer.Program::‏‍‍‍‮‮‎‪‬‬‎‍‮‬‏‮‬‎‮‌‎‪‮‍​‫‮(System.Exception)
ldstr 

The application will now close.
call System.String EventLogAnalyzer.Program::‫‭‬‪‮‏‏‬​‮‪‫‏‎‫‬‮‪‍‎‮‪‪‎‪‭‏‌‮(System.String,System.String,System.String)
ldstr Critical Error
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult EventLogAnalyzer.Program::​‬‭‎‮‮​‏‮‪‌‏‌‭‍‪‎‪‍‮(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
ldc.i4 -1828270323
ldc.i4 -685651977
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.3 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_010F: leave.s IL_0111
nop <null>
ldloc.1 <null>
ldc.i4 1071812520
mul <null>
ldc.i4 1667231319
xor <null>
br.s IL_00E2: ldc.i4 -685651977
leave.s IL_0111: ret
ret <null>
9e76617f3bb207e3bbdb2df9528d33ee
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
EventLogAnalyzer.Forms.MainForm.resources
EventLogAnalyzer.Properties.Resources.resources
IO
[NBF]root.Data
mcYR
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙