Malicious
Malicious

b9843deccf7c8beb698a953fc31bd98b

PE Executable
MD5: b9843deccf7c8beb698a953fc31bd98b
Size: 955.9 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
955.9 KB · 955,904 B
First seen
2026-09-10 11:01 · one month ago
Last seen
2026-09-10 11:01 · one month ago
Last analysis
2026-09-10 11:03 · one month ago
Hashes
MD5 b9843deccf7c8beb698a953fc31bd98b Sha1 a7fb82ca4fe371ca52b9e8d73fd017e80f42e68b Sha256 f93cf30712e2c5a8ed4942a7440cfc6c0e8787a9d94d937e56bba95baae19888 Sha384 4a49ee19d26be8ec419a4e3626f1e4360a12eabfca7167d0ee7ea412e0192acfe5b6f76279696ff4c755a5aeeec5eafc Sha512 654993bad7e1b831ac70fbf7cc190bbf0fdb06054cd8b1a2e662c231d9ac02a9077a0c661b18aeb912d5e7a0b518703bffcdfa44d49a8c6fab456fc754e57601 SSDeep 24576:5wjP/2oSdvdG5gr7hiilXBSr9ky/m2LdmT7kLj:5wb/2oSDgLifSnxw7kH TLSH AB1502042157DD02D1E51FB058F0E7B416B44E84B922D7078EEA7EEB7A7F78A2E412D2
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
High
1 malicious · 24 files
EXEb9843deccf7c8beb698a953fc31bd98b
Structure
BINResources
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINmTS.GTd.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINPro
DATA[NBF]root.Data
BINbackgroundWorker1.TrayLocation
BINgTj.rTh.resources
BINSTU.OTX.resources
BINaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINprogressBar1.Modifiers
BIN$this.Language
BIN$this.GridSize
BINNeuralLinkDataMiner.Properties.Resources.resources
BINRUJC
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Name Value
Module Name
YpVY.exe
Full Name
YpVY.exe
EntryPoint
System.Void nQ.SW::Gd()
Scope Name
YpVY.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
YpVY
Assembly Version
8.6.4.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
149
Info
PDB Path: YpVY.pdb
Main Method
System.Void nQ.SW::Gd()
Main IL Instruction Count
16
Main IL 
br IL_0021: nop
nop <null>
ret <null>
nop <null>
newobj System.Void mTS.GTd::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0005: nop
call System.Void Eay.waZ::WvF()
br IL_0007: nop
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_002C: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0017: call System.Void Eay.waZ::WvF()
Module Name
YpVY.exe
Full Name
YpVY.exe
EntryPoint
System.Void nQ.SW::Gd()
Scope Name
YpVY.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
YpVY
Assembly Version
8.6.4.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
149
Main Method
System.Void nQ.SW::Gd()
Main IL Instruction Count
16
Main IL 
br IL_0021: nop
nop <null>
ret <null>
nop <null>
newobj System.Void mTS.GTd::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0005: nop
call System.Void Eay.waZ::WvF()
br IL_0007: nop
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_002C: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0017: call System.Void Eay.waZ::WvF()
1 malicious · 24 files
EXEb9843deccf7c8beb698a953fc31bd98b
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙