Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 5 files
EXEe6f23b585f334e448080d920a772342a
Structure
Name Value
Module Name
Teygd.exe
Full Name
Teygd.exe
EntryPoint
System.Void Teygd.Dwlyiwfaiun::Main()
Scope Name
Teygd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Teygd
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void Teygd.Dwlyiwfaiun::Main()
Main IL Instruction Count
111
Main IL 
ldc.i4 3
stloc V_3
br IL_000E: ldloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_01C1: nop
nop <null>
ldloc.s V_2
call System.Byte[] Teygd.Properties.Ihwpv::get_Myhiunz()
ldsfld System.Object aEscZltjQVGoR8xUuF.FI8LhCoCyXk9jYqjk4::DtIQP2GaW
ldsfld System.Object aEscZltjQVGoR8xUuF.FI8LhCoCyXk9jYqjk4::UIfiEkmmh
ldc.i4 1465764696
ldc.i4 659720676
xor <null>
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_12a8ae6b17884b068fc7c2567a8b6be1
xor <null>
call System.String paXqX4seGpSFORtpYfY.ewaXJvsltU8Hvgjpwqx::q8Ds5kFFC8(System.Int32)
ldc.i4 1424138078
ldc.i4 1477208457
xor <null>
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_cdbb56dd5f3940c0b065ba30f15cbc8e
xor <null>
call System.String paXqX4seGpSFORtpYfY.ewaXJvsltU8Hvgjpwqx::q8Ds5kFFC8(System.Int32)
ldnull <null>
callvirt System.Void Teygd.Gcbqlivcjoe::Fwafq(System.Byte[],System.Byte[],System.Byte[],System.String,System.String,System.Object[])
ldc.i4 0
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_d4eefae3f23f4a19a5289053cbad119b
brfalse IL_00A9: switch(IL_00BB,IL_00DF)
pop <null>
ldc.i4 0
br IL_00A9: switch(IL_00BB,IL_00DF)
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
br IL_00BB: br IL_00DF
br IL_00DF: leave IL_0162
ldc.i4 0
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_aa2a18ef69824e9991909dc2a7e72bf7
brfalse IL_00A9: switch(IL_00BB,IL_00DF)
pop <null>
ldc.i4 1
br IL_00A9: switch(IL_00BB,IL_00DF)
leave IL_0162: ret
pop <null>
ldc.i4 1
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_55dfdc67210c47398fde442f3498fd89
brfalse IL_0108: switch(IL_013E,IL_011A)
pop <null>
ldc.i4 0
br IL_0108: switch(IL_013E,IL_011A)
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_013E: leave IL_0162
br IL_013E: leave IL_0162
ldc.i4 0
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_b694e434cb9e44d9853a151d953cfcf7
brtrue IL_0108: switch(IL_013E,IL_011A)
pop <null>
ldc.i4 0
br IL_0108: switch(IL_013E,IL_011A)
leave IL_0162: ret
ldc.i4 6
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_b3743171d79141dfaf754a883108fcdb
brtrue IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
pop <null>
ldc.i4 4
br IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
ret <null>
newobj System.Void Teygd.Gcbqlivcjoe::.ctor()
stloc.s V_2
ldc.i4 5
br IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
br IL_01C1: nop
call System.Void RvY8nTGn6FAEWaRGcsJ.rrTEJ4GerLICTKW5Mfp::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 2
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_a47604e649714571a2b9041265be3581
brtrue IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
pop <null>
ldc.i4 2
br IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
br IL_0163: newobj System.Void Teygd.Gcbqlivcjoe::.ctor()
ldc.i4 0
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_40bc9be246344c21bdf73691cc81889d
brtrue IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
nop <null>
ldc.i4 2
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_344dd9cf5d5f4b8abd80273a8df6351f
brtrue IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
pop <null>
ldc.i4 4
br IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
br IL_0162: ret
ldc.i4 1
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_4300486c40fe453eb0b77af8b00a26eb
brtrue IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
Module Name
Teygd.exe
Full Name
Teygd.exe
EntryPoint
System.Void Teygd.Dwlyiwfaiun::Main()
Scope Name
Teygd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Teygd
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void Teygd.Dwlyiwfaiun::Main()
Main IL Instruction Count
111
Main IL 
ldc.i4 3
stloc V_3
br IL_000E: ldloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_01C1: nop
nop <null>
ldloc.s V_2
call System.Byte[] Teygd.Properties.Ihwpv::get_Myhiunz()
ldsfld System.Object aEscZltjQVGoR8xUuF.FI8LhCoCyXk9jYqjk4::DtIQP2GaW
ldsfld System.Object aEscZltjQVGoR8xUuF.FI8LhCoCyXk9jYqjk4::UIfiEkmmh
ldc.i4 1465764696
ldc.i4 659720676
xor <null>
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_12a8ae6b17884b068fc7c2567a8b6be1
xor <null>
call System.String paXqX4seGpSFORtpYfY.ewaXJvsltU8Hvgjpwqx::q8Ds5kFFC8(System.Int32)
ldc.i4 1424138078
ldc.i4 1477208457
xor <null>
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_cdbb56dd5f3940c0b065ba30f15cbc8e
xor <null>
call System.String paXqX4seGpSFORtpYfY.ewaXJvsltU8Hvgjpwqx::q8Ds5kFFC8(System.Int32)
ldnull <null>
callvirt System.Void Teygd.Gcbqlivcjoe::Fwafq(System.Byte[],System.Byte[],System.Byte[],System.String,System.String,System.Object[])
ldc.i4 0
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_d4eefae3f23f4a19a5289053cbad119b
brfalse IL_00A9: switch(IL_00BB,IL_00DF)
pop <null>
ldc.i4 0
br IL_00A9: switch(IL_00BB,IL_00DF)
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
br IL_00BB: br IL_00DF
br IL_00DF: leave IL_0162
ldc.i4 0
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_aa2a18ef69824e9991909dc2a7e72bf7
brfalse IL_00A9: switch(IL_00BB,IL_00DF)
pop <null>
ldc.i4 1
br IL_00A9: switch(IL_00BB,IL_00DF)
leave IL_0162: ret
pop <null>
ldc.i4 1
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_55dfdc67210c47398fde442f3498fd89
brfalse IL_0108: switch(IL_013E,IL_011A)
pop <null>
ldc.i4 0
br IL_0108: switch(IL_013E,IL_011A)
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_013E: leave IL_0162
br IL_013E: leave IL_0162
ldc.i4 0
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_b694e434cb9e44d9853a151d953cfcf7
brtrue IL_0108: switch(IL_013E,IL_011A)
pop <null>
ldc.i4 0
br IL_0108: switch(IL_013E,IL_011A)
leave IL_0162: ret
ldc.i4 6
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_b3743171d79141dfaf754a883108fcdb
brtrue IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
pop <null>
ldc.i4 4
br IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
ret <null>
newobj System.Void Teygd.Gcbqlivcjoe::.ctor()
stloc.s V_2
ldc.i4 5
br IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
br IL_01C1: nop
call System.Void RvY8nTGn6FAEWaRGcsJ.rrTEJ4GerLICTKW5Mfp::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 2
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_a47604e649714571a2b9041265be3581
brtrue IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
pop <null>
ldc.i4 2
br IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
br IL_0163: newobj System.Void Teygd.Gcbqlivcjoe::.ctor()
ldc.i4 0
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_40bc9be246344c21bdf73691cc81889d
brtrue IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
nop <null>
ldc.i4 2
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_344dd9cf5d5f4b8abd80273a8df6351f
brtrue IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
pop <null>
ldc.i4 4
br IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
br IL_0162: ret
ldc.i4 1
ldsfld <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10} <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_57ad7fc69c754f369c8b9ee3b81b5f11
ldfld System.Int32 <Module>{73c61d4b-1e9a-4f46-b733-11316c7d5b10}::m_4300486c40fe453eb0b77af8b00a26eb
brtrue IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_01C1,IL_0162,IL_019D,IL_0179,IL_0038,IL_0174,IL_01E1)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙