Suspicious
Suspect

ede2561f5b9fbda76208d3b51bae5a9d

PE Executable
MD5: ede2561f5b9fbda76208d3b51bae5a9d
Size: 444.42 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 ede2561f5b9fbda76208d3b51bae5a9d
Sha1 fa44c3fc012291195d74a038a665cc06eecc543d
Sha256 bc69f75dde5ee8f13b251ae9fc5419047e36d2cbd85273d305bfa8dd127cc7a4
Sha384 421f8f234a18f6e51efc8711b194b1321488ec21c7d2e13daf32207756eac96694a7638c4f5c112e7922454b10ea10c8
Sha512 053f5da0e409b6de639b9a9faf519ec1d6b84d0f273f49ab7c96f12e15eca3ef88942a66b2edc769b9816034339e658c97e978f1c4e2baa705ded4dc8a5eeefe
SSDeep 6144:cZaoampKQse4adUDlNyLu/zihpWJm7a+2ogkfyEe+XDAaCY8OBIfC0+VX:QOmbse4adUZGueQ4a+2IbRApY8s0mX
TLSH 7994DF44A383CA4BC6BD373CC8B41AF4063F6D95E631D71F18817D6A3AB5B8248357A6
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
ede2561f5b9fbda76208d3b51bae5a9d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0-preview.png
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
ID:0009
ID:0
ID:000A
ID:0
ID:000B
ID:0
ID:000C
ID:0
ID:000D
ID:0
ID:000E
ID:0
ID:000F
ID:0
ID:0010
ID:0
ID:0011
ID:0
ID:0012
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Nyxos2.hero.jpg
Nyxos2.hero.jpg-preview.png
Nyxos2.logo.png
Nyxos2.logo.png-preview.png
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

img 2bin 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Nyxos2Patcher.exe
Full Name
Nyxos2Patcher.exe
EntryPoint
System.Void Nyxos2.Program::Main()
Scope Name
Nyxos2Patcher.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nyxos2Patcher
Assembly Version
1.1.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
309
Main Method
System.Void Nyxos2.Program::Main()
Main IL Instruction Count
58
Main IL 
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_BaseDirectory()
ldc.i4.1 <null>
newarr System.Char
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
ldc.i4.s 92
stelem.i2 <null>
ldloc.s V_5
callvirt System.String System.String::TrimEnd(System.Char[])
callvirt System.String System.String::ToLowerInvariant()
stloc.0 <null>
call System.Security.Cryptography.SHA256 System.Security.Cryptography.SHA256::Create()
stloc.2 <null>
ldstr Nyxos2Patcher_
ldloc.2 <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldloc.0 <null>
callvirt System.Byte[] System.Text.Encoding::GetBytes(System.String)
callvirt System.Byte[] System.Security.Cryptography.HashAlgorithm::ComputeHash(System.Byte[])
ldc.i4.0 <null>
ldc.i4.8 <null>
call System.String System.BitConverter::ToString(System.Byte[],System.Int32,System.Int32)
ldstr -
ldstr 
callvirt System.String System.String::Replace(System.String,System.String)
call System.String System.String::Concat(System.String,System.String)
stloc.1 <null>
leave.s IL_0069: ldc.i4.1
ldloc.2 <null>
brfalse.s IL_0068: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldc.i4.1 <null>
ldloc.1 <null>
ldloca.s V_3
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.s V_4
ldloc.3 <null>
brtrue.s IL_007E: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
call System.Void Nyxos2.Program::BringOtherToFront()
leave.s IL_00A8: ret
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Nyxos2.PatcherForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldloc.s V_4
call System.Void System.GC::KeepAlive(System.Object)
leave.s IL_00A8: ret
ldloc.s V_4
brfalse.s IL_00A7: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ret <null>
Module Name
Nyxos2Patcher.exe
Full Name
Nyxos2Patcher.exe
EntryPoint
System.Void Nyxos2.Program::Main()
Scope Name
Nyxos2Patcher.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nyxos2Patcher
Assembly Version
1.1.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
309
Main Method
System.Void Nyxos2.Program::Main()
Main IL Instruction Count
58
Main IL 
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_BaseDirectory()
ldc.i4.1 <null>
newarr System.Char
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
ldc.i4.s 92
stelem.i2 <null>
ldloc.s V_5
callvirt System.String System.String::TrimEnd(System.Char[])
callvirt System.String System.String::ToLowerInvariant()
stloc.0 <null>
call System.Security.Cryptography.SHA256 System.Security.Cryptography.SHA256::Create()
stloc.2 <null>
ldstr Nyxos2Patcher_
ldloc.2 <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldloc.0 <null>
callvirt System.Byte[] System.Text.Encoding::GetBytes(System.String)
callvirt System.Byte[] System.Security.Cryptography.HashAlgorithm::ComputeHash(System.Byte[])
ldc.i4.0 <null>
ldc.i4.8 <null>
call System.String System.BitConverter::ToString(System.Byte[],System.Int32,System.Int32)
ldstr -
ldstr 
callvirt System.String System.String::Replace(System.String,System.String)
call System.String System.String::Concat(System.String,System.String)
stloc.1 <null>
leave.s IL_0069: ldc.i4.1
ldloc.2 <null>
brfalse.s IL_0068: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldc.i4.1 <null>
ldloc.1 <null>
ldloca.s V_3
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.s V_4
ldloc.3 <null>
brtrue.s IL_007E: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
call System.Void Nyxos2.Program::BringOtherToFront()
leave.s IL_00A8: ret
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Nyxos2.PatcherForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldloc.s V_4
call System.Void System.GC::KeepAlive(System.Object)
leave.s IL_00A8: ret
ldloc.s V_4
brfalse.s IL_00A7: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ret <null>
ede2561f5b9fbda76208d3b51bae5a9d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0-preview.png
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
ID:0009
ID:0
ID:000A
ID:0
ID:000B
ID:0
ID:000C
ID:0
ID:000D
ID:0
ID:000E
ID:0
ID:000F
ID:0
ID:0010
ID:0
ID:0011
ID:0
ID:0012
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Nyxos2.hero.jpg
Nyxos2.hero.jpg-preview.png
Nyxos2.logo.png
Nyxos2.logo.png-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙