Malicious
Malicious

c7ffd01310d80e2983ec4027232b5b63

Share on LinkedIn
Print
PE Executable
MD5: c7ffd01310d80e2983ec4027232b5b63
Size: 829.95 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
829.95 KB · 829,952 B
First seen
2026-07-28 06:47 · 3 months ago
Last seen
2026-07-28 06:47 · 3 months ago
Last analysis
2026-07-28 06:47 · 3 months ago
Hashes
MD5 c7ffd01310d80e2983ec4027232b5b63 Sha1 61892efc7de79c7871b88076dc0a7441a2cc058f Sha256 aa4948508c0c98758400c5b167319a5fc45fa2bdec45c352db96719e3b075362 Sha384 0af6bc3d1dcfb49949ec80db2486656864cf4b432c8c896daa87da83774c15e5ae5408b143e40d1568dc27def820374b Sha512 5b73e5df6c51290cc02fbc50ad59dafe0329bdb626155984a2afd92ab3757cb0101558d89fc688c92a322e7bcce0ca0d3b810020f31eab055a16129a8785e105 SSDeep 12288:cdZ2p2SkpWC+ZGmiU0bPO4C1C6ITrZZlwf6gUZaDN0H6:cd8SeYmizPgC6ICf6gU0DM6 TLSH 5405BF7A36998E25C14A5333D1C7890083E69A8737E7FB0B358903D619063FEDA4A7D7
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
Symbol obfuscation
Very high
1 malicious · 7 files
EXEc7ffd01310d80e2983ec4027232b5b63
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Evgntcuwp.exe
Full Name
Evgntcuwp.exe
EntryPoint
System.Void T1UGnEp2I24TeLue60.UUyLys6TjRQaW25NUm::IZjgBX2uB()
Scope Name
Evgntcuwp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Evgntcuwp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void T1UGnEp2I24TeLue60.UUyLys6TjRQaW25NUm::IZjgBX2uB()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0192: ldsfld TJTJtU6XTXjB1IP3FyD TJTJtU6XTXjB1IP3FyD::l8Q62XASJe
ret <null>
nop <null>
ldsfld znhOr16AjdnmimxEU57 znhOr16AjdnmimxEU57::jY86cJ0xJX
call System.Byte[] znhOr16AjdnmimxEU57::Ckt6y0JFUf(znhOr16AjdnmimxEU57)
stloc.s V_0
ldc.i4 0
ldsfld <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd} <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_fff8bfa1aae343cca83cade278c995b5
ldfld System.Int32 <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_47656ae2dc5542d8b7870af542ef0f8b
brfalse IL_0077: switch(IL_0097,IL_011B)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_011B)
br IL_0073: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0073: ldloc V_1
br IL_0097: ldc.i4 -2100423516
ldc.i4 -2100423516
ldc.i4 -2041150813
xor <null>
ldsfld <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd} <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_fff8bfa1aae343cca83cade278c995b5
ldfld System.Int32 <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_a325d93465604320b29273bc7f693590
xor <null>
ldsfld Kx0HHF667E7IdSaR6r0 Kx0HHF667E7IdSaR6r0::opU6pqHRQH
call System.String Kx0HHF667E7IdSaR6r0::Ckt6y0JFUf(System.Int32,Kx0HHF667E7IdSaR6r0)
ldc.i4 -2100423516
ldc.i4 -2093899310
xor <null>
ldsfld <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd} <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_fff8bfa1aae343cca83cade278c995b5
ldfld System.Int32 <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_8ab763d4a41f4f079fcf27c5e39a15d6
xor <null>
ldsfld Kx0HHF667E7IdSaR6r0 Kx0HHF667E7IdSaR6r0::opU6pqHRQH
call System.String Kx0HHF667E7IdSaR6r0::Ckt6y0JFUf(System.Int32,Kx0HHF667E7IdSaR6r0)
newobj System.Void IaUefSWatJFnsKhQYId.TTYjjEWykYerxot7vl7::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld Lnfodt6gRV8LYCe46jA Lnfodt6gRV8LYCe46jA::YWl619iYPq
call IaUefSWatJFnsKhQYId.TTYjjEWykYerxot7vl7 Lnfodt6gRV8LYCe46jA::Ckt6y0JFUf(System.Object,System.Byte[],Lnfodt6gRV8LYCe46jA)
ldsfld Qpoa696vq9RFgHpSLUE Qpoa696vq9RFgHpSLUE::aK66I8Mkog
call IaUefSWatJFnsKhQYId.TTYjjEWykYerxot7vl7 Qpoa696vq9RFgHpSLUE::Ckt6y0JFUf(System.Object,Qpoa696vq9RFgHpSLUE)
ldsfld jvDHYU6uBaGr0Jy2NDY jvDHYU6uBaGr0Jy2NDY::cux68ilj3e
call System.Void jvDHYU6uBaGr0Jy2NDY::Ckt6y0JFUf(System.Object,jvDHYU6uBaGr0Jy2NDY)
ldc.i4 1
ldsfld <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd} <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_fff8bfa1aae343cca83cade278c995b5
ldfld System.Int32 <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_40b39f7f682741d783b1730fa8bccac0
brfalse IL_0077: switch(IL_0097,IL_011B)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_011B)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd} <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_fff8bfa1aae343cca83cade278c995b5
ldfld System.Int32 <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_753d40e63d14455a9ef42c787c8ff18b
brtrue IL_0152: switch(IL_016E)
pop <null>
ldc.i4 0
br IL_0152: switch(IL_016E)
br IL_014E: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014E: ldloc V_2
br IL_016E: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd} <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_fff8bfa1aae343cca83cade278c995b5
ldfld System.Int32 <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_d9e4461c9a5046e88d3e6a642c55d099
brfalse IL_0014: switch(IL_0038,IL_0039,IL_0192)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0039,IL_0192)
ldsfld TJTJtU6XTXjB1IP3FyD TJTJtU6XTXjB1IP3FyD::l8Q62XASJe
call System.Void TJTJtU6XTXjB1IP3FyD::Ckt6y0JFUf(TJTJtU6XTXjB1IP3FyD)
ldc.i4 1
ldsfld <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd} <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_fff8bfa1aae343cca83cade278c995b5
ldfld System.Int32 <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_fcc93919b9f943729ef08b77e2397d13
brfalse IL_0014: switch(IL_0038,IL_0039,IL_0192)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0039,IL_0192)
Module Name
Evgntcuwp.exe
Full Name
Evgntcuwp.exe
EntryPoint
System.Void T1UGnEp2I24TeLue60.UUyLys6TjRQaW25NUm::IZjgBX2uB()
Scope Name
Evgntcuwp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Evgntcuwp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void T1UGnEp2I24TeLue60.UUyLys6TjRQaW25NUm::IZjgBX2uB()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0192: ldsfld TJTJtU6XTXjB1IP3FyD TJTJtU6XTXjB1IP3FyD::l8Q62XASJe
ret <null>
nop <null>
ldsfld znhOr16AjdnmimxEU57 znhOr16AjdnmimxEU57::jY86cJ0xJX
call System.Byte[] znhOr16AjdnmimxEU57::Ckt6y0JFUf(znhOr16AjdnmimxEU57)
stloc.s V_0
ldc.i4 0
ldsfld <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd} <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_fff8bfa1aae343cca83cade278c995b5
ldfld System.Int32 <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_47656ae2dc5542d8b7870af542ef0f8b
brfalse IL_0077: switch(IL_0097,IL_011B)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_011B)
br IL_0073: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0073: ldloc V_1
br IL_0097: ldc.i4 -2100423516
ldc.i4 -2100423516
ldc.i4 -2041150813
xor <null>
ldsfld <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd} <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_fff8bfa1aae343cca83cade278c995b5
ldfld System.Int32 <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_a325d93465604320b29273bc7f693590
xor <null>
ldsfld Kx0HHF667E7IdSaR6r0 Kx0HHF667E7IdSaR6r0::opU6pqHRQH
call System.String Kx0HHF667E7IdSaR6r0::Ckt6y0JFUf(System.Int32,Kx0HHF667E7IdSaR6r0)
ldc.i4 -2100423516
ldc.i4 -2093899310
xor <null>
ldsfld <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd} <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_fff8bfa1aae343cca83cade278c995b5
ldfld System.Int32 <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_8ab763d4a41f4f079fcf27c5e39a15d6
xor <null>
ldsfld Kx0HHF667E7IdSaR6r0 Kx0HHF667E7IdSaR6r0::opU6pqHRQH
call System.String Kx0HHF667E7IdSaR6r0::Ckt6y0JFUf(System.Int32,Kx0HHF667E7IdSaR6r0)
newobj System.Void IaUefSWatJFnsKhQYId.TTYjjEWykYerxot7vl7::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld Lnfodt6gRV8LYCe46jA Lnfodt6gRV8LYCe46jA::YWl619iYPq
call IaUefSWatJFnsKhQYId.TTYjjEWykYerxot7vl7 Lnfodt6gRV8LYCe46jA::Ckt6y0JFUf(System.Object,System.Byte[],Lnfodt6gRV8LYCe46jA)
ldsfld Qpoa696vq9RFgHpSLUE Qpoa696vq9RFgHpSLUE::aK66I8Mkog
call IaUefSWatJFnsKhQYId.TTYjjEWykYerxot7vl7 Qpoa696vq9RFgHpSLUE::Ckt6y0JFUf(System.Object,Qpoa696vq9RFgHpSLUE)
ldsfld jvDHYU6uBaGr0Jy2NDY jvDHYU6uBaGr0Jy2NDY::cux68ilj3e
call System.Void jvDHYU6uBaGr0Jy2NDY::Ckt6y0JFUf(System.Object,jvDHYU6uBaGr0Jy2NDY)
ldc.i4 1
ldsfld <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd} <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_fff8bfa1aae343cca83cade278c995b5
ldfld System.Int32 <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_40b39f7f682741d783b1730fa8bccac0
brfalse IL_0077: switch(IL_0097,IL_011B)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_011B)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd} <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_fff8bfa1aae343cca83cade278c995b5
ldfld System.Int32 <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_753d40e63d14455a9ef42c787c8ff18b
brtrue IL_0152: switch(IL_016E)
pop <null>
ldc.i4 0
br IL_0152: switch(IL_016E)
br IL_014E: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014E: ldloc V_2
br IL_016E: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd} <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_fff8bfa1aae343cca83cade278c995b5
ldfld System.Int32 <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_d9e4461c9a5046e88d3e6a642c55d099
brfalse IL_0014: switch(IL_0038,IL_0039,IL_0192)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0039,IL_0192)
ldsfld TJTJtU6XTXjB1IP3FyD TJTJtU6XTXjB1IP3FyD::l8Q62XASJe
call System.Void TJTJtU6XTXjB1IP3FyD::Ckt6y0JFUf(TJTJtU6XTXjB1IP3FyD)
ldc.i4 1
ldsfld <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd} <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_fff8bfa1aae343cca83cade278c995b5
ldfld System.Int32 <Module>{280f2b5a-1ac1-4486-a6d1-8411dcc428fd}::m_fcc93919b9f943729ef08b77e2397d13
brfalse IL_0014: switch(IL_0038,IL_0039,IL_0192)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0039,IL_0192)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙