Malicious
Malicious

d7f8be65f55b52a7c2715e73427f503a

PE Executable
MD5: d7f8be65f55b52a7c2715e73427f503a
Size: 422.91 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
422.91 KB · 422,912 B
First seen
2026-07-03 06:03 · 3 months ago
Last seen
2026-07-03 06:03 · 3 months ago
Last analysis
2026-07-05 22:52 · 3 months ago
Hashes
MD5 d7f8be65f55b52a7c2715e73427f503a Sha1 34ef7583212201de03136d6e83b48e6f736e52b3 Sha256 f12551c00b42be18bb6ffc4d046a4a87bde645cb4c457673659c8e1c879110c0 Sha384 48a8862f5ae4f66e03a5c8f8a30d0df926a152dc906c586ba863bb7e8f81a6b8f037c9bf8755432f4340b337c11503ca Sha512 7ca9485cf340b7f19bd4f77a5bd39cef08e9b01f4d4db24962130e54614ba72d49be2cf2b523a0aa6c99cce6538f65bfea613331c01057590e9d7d6998b9bd01 SSDeep 6144:b+dRbwuFcTQbXBw4GcRAniXhCtyChkoIRHxzAreSNubQ:bwOMBw4GcWniuvb6xcr TLSH F5941A6736564F20D1880333C1EB014187F9AA8776B3F70F768513AA1D533FEEA4A696
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXEd7f8be65f55b52a7c2715e73427f503a
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BIN8Q5FEMLtA23YaGrEHv.r415TvmCTcuFnEsUn7
BINsfFbTA39vOnjtCBJW0.FMSdHRDLfAxtEQ4ek1
BINarqHVwWTDtM9Lu9Yvq.hZmoabxY9JGJYJZBcT
BINYu8VOR2NjQSR85f8SG.1WF4lHianws1QXB1t9
Name Value
Module Name
Qykwvo.exe
Full Name
Qykwvo.exe
EntryPoint
System.Void E8bxrGZQgU3gZQfW6r.RxO2RDV8DKHCjJJO23::iBaFS6kIf()
Scope Name
Qykwvo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Qykwvo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void E8bxrGZQgU3gZQfW6r.RxO2RDV8DKHCjJJO23::iBaFS6kIf()
Main IL Instruction Count
68
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0117: ldsfld sA6oYumnnlsB0w9JvvJ sA6oYumnnlsB0w9JvvJ::JHmma5Cqj9
ret <null>
nop <null>
newobj System.Void iNEx8Ok2Z08AsGMGem.iYasTMXHh6S44tXVU2::.ctor()
ldsfld lAjtxHmONw7DxFnCgmq lAjtxHmONw7DxFnCgmq::JlimCjiVIE
call System.Byte[] lAjtxHmONw7DxFnCgmq::tr4mGKMfwA(lAjtxHmONw7DxFnCgmq)
ldsfld F9eHTvmYGF7YS1AW655 F9eHTvmYGF7YS1AW655::uXfm5Cx3fZ
call System.Void F9eHTvmYGF7YS1AW655::tr4mGKMfwA(System.Object,System.Byte[],F9eHTvmYGF7YS1AW655)
ldc.i4 0
ldsfld <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316} <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316}::m_a3cefd3bf26d415d9236291bfbc07432
ldfld System.Int32 <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316}::m_94b0bcd34f314f2f9a7e7f70cb2eb38a
brfalse IL_0084: switch(IL_00A0)
pop <null>
ldc.i4 0
br IL_0084: switch(IL_00A0)
br IL_0080: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0080: ldloc V_0
br IL_00A0: leave IL_0038
leave IL_0038: ret
pop <null>
ldc.i4 1
ldsfld <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316} <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316}::m_a3cefd3bf26d415d9236291bfbc07432
ldfld System.Int32 <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316}::m_6dc6bff97845409090f96f35089332ce
brtrue IL_00D7: switch(IL_00F3)
pop <null>
ldc.i4 0
br IL_00D7: switch(IL_00F3)
br IL_00D3: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_00D3: ldloc V_1
br IL_00F3: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316} <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316}::m_a3cefd3bf26d415d9236291bfbc07432
ldfld System.Int32 <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316}::m_aad0a1f624d34277827ba772d1196100
brtrue IL_0014: switch(IL_0039,IL_0117,IL_0038)
pop <null>
ldc.i4 3
br IL_0014: switch(IL_0039,IL_0117,IL_0038)
ldsfld sA6oYumnnlsB0w9JvvJ sA6oYumnnlsB0w9JvvJ::JHmma5Cqj9
call System.Void sA6oYumnnlsB0w9JvvJ::tr4mGKMfwA(sA6oYumnnlsB0w9JvvJ)
ldc.i4 3
ldsfld <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316} <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316}::m_a3cefd3bf26d415d9236291bfbc07432
ldfld System.Int32 <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316}::m_88119062f9af4ac99dee2f4d7c455d74
brtrue IL_0014: switch(IL_0039,IL_0117,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0039,IL_0117,IL_0038)
Module Name
Qykwvo.exe
Full Name
Qykwvo.exe
EntryPoint
System.Void E8bxrGZQgU3gZQfW6r.RxO2RDV8DKHCjJJO23::iBaFS6kIf()
Scope Name
Qykwvo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Qykwvo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void E8bxrGZQgU3gZQfW6r.RxO2RDV8DKHCjJJO23::iBaFS6kIf()
Main IL Instruction Count
68
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0117: ldsfld sA6oYumnnlsB0w9JvvJ sA6oYumnnlsB0w9JvvJ::JHmma5Cqj9
ret <null>
nop <null>
newobj System.Void iNEx8Ok2Z08AsGMGem.iYasTMXHh6S44tXVU2::.ctor()
ldsfld lAjtxHmONw7DxFnCgmq lAjtxHmONw7DxFnCgmq::JlimCjiVIE
call System.Byte[] lAjtxHmONw7DxFnCgmq::tr4mGKMfwA(lAjtxHmONw7DxFnCgmq)
ldsfld F9eHTvmYGF7YS1AW655 F9eHTvmYGF7YS1AW655::uXfm5Cx3fZ
call System.Void F9eHTvmYGF7YS1AW655::tr4mGKMfwA(System.Object,System.Byte[],F9eHTvmYGF7YS1AW655)
ldc.i4 0
ldsfld <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316} <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316}::m_a3cefd3bf26d415d9236291bfbc07432
ldfld System.Int32 <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316}::m_94b0bcd34f314f2f9a7e7f70cb2eb38a
brfalse IL_0084: switch(IL_00A0)
pop <null>
ldc.i4 0
br IL_0084: switch(IL_00A0)
br IL_0080: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0080: ldloc V_0
br IL_00A0: leave IL_0038
leave IL_0038: ret
pop <null>
ldc.i4 1
ldsfld <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316} <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316}::m_a3cefd3bf26d415d9236291bfbc07432
ldfld System.Int32 <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316}::m_6dc6bff97845409090f96f35089332ce
brtrue IL_00D7: switch(IL_00F3)
pop <null>
ldc.i4 0
br IL_00D7: switch(IL_00F3)
br IL_00D3: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_00D3: ldloc V_1
br IL_00F3: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316} <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316}::m_a3cefd3bf26d415d9236291bfbc07432
ldfld System.Int32 <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316}::m_aad0a1f624d34277827ba772d1196100
brtrue IL_0014: switch(IL_0039,IL_0117,IL_0038)
pop <null>
ldc.i4 3
br IL_0014: switch(IL_0039,IL_0117,IL_0038)
ldsfld sA6oYumnnlsB0w9JvvJ sA6oYumnnlsB0w9JvvJ::JHmma5Cqj9
call System.Void sA6oYumnnlsB0w9JvvJ::tr4mGKMfwA(sA6oYumnnlsB0w9JvvJ)
ldc.i4 3
ldsfld <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316} <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316}::m_a3cefd3bf26d415d9236291bfbc07432
ldfld System.Int32 <Module>{421da9a2-401c-4e3f-aeb3-56d3feb70316}::m_88119062f9af4ac99dee2f4d7c455d74
brtrue IL_0014: switch(IL_0039,IL_0117,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0039,IL_0117,IL_0038)
1 malicious · 7 files
EXEd7f8be65f55b52a7c2715e73427f503a
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙