Suspicious
Suspect

ede2561f5b9fbda76208d3b51bae5a9d

Share on LinkedIn
Print
PE Executable
MD5: ede2561f5b9fbda76208d3b51bae5a9d
Size: 444.42 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 ede2561f5b9fbda76208d3b51bae5a9d
Sha1 fa44c3fc012291195d74a038a665cc06eecc543d
Sha256 bc69f75dde5ee8f13b251ae9fc5419047e36d2cbd85273d305bfa8dd127cc7a4
Sha384 421f8f234a18f6e51efc8711b194b1321488ec21c7d2e13daf32207756eac96694a7638c4f5c112e7922454b10ea10c8
Sha512 053f5da0e409b6de639b9a9faf519ec1d6b84d0f273f49ab7c96f12e15eca3ef88942a66b2edc769b9816034339e658c97e978f1c4e2baa705ded4dc8a5eeefe
SSDeep 6144:cZaoampKQse4adUDlNyLu/zihpWJm7a+2ogkfyEe+XDAaCY8OBIfC0+VX:QOmbse4adUZGueQ4a+2IbRApY8s0mX
TLSH 7994DF44A383CA4BC6BD373CC8B41AF4063F6D95E631D71F18817D6A3AB5B8248357A6
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
ede2561f5b9fbda76208d3b51bae5a9d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0-preview.png
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
ID:0009
ID:0
ID:000A
ID:0
ID:000B
ID:0
ID:000C
ID:0
ID:000D
ID:0
ID:000E
ID:0
ID:000F
ID:0
ID:0010
ID:0
ID:0011
ID:0
ID:0012
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Nyxos2.hero.jpg
Nyxos2.hero.jpg-preview.png
Nyxos2.logo.png
Nyxos2.logo.png-preview.png
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

img 2bin 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Nyxos2Patcher.exe
Full Name
Nyxos2Patcher.exe
EntryPoint
System.Void Nyxos2.Program::Main()
Scope Name
Nyxos2Patcher.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nyxos2Patcher
Assembly Version
1.1.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
309
Main Method
System.Void Nyxos2.Program::Main()
Main IL Instruction Count
58
Main IL 
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_BaseDirectory()
ldc.i4.1 <null>
newarr System.Char
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
ldc.i4.s 92
stelem.i2 <null>
ldloc.s V_5
callvirt System.String System.String::TrimEnd(System.Char[])
callvirt System.String System.String::ToLowerInvariant()
stloc.0 <null>
call System.Security.Cryptography.SHA256 System.Security.Cryptography.SHA256::Create()
stloc.2 <null>
ldstr Nyxos2Patcher_
ldloc.2 <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldloc.0 <null>
callvirt System.Byte[] System.Text.Encoding::GetBytes(System.String)
callvirt System.Byte[] System.Security.Cryptography.HashAlgorithm::ComputeHash(System.Byte[])
ldc.i4.0 <null>
ldc.i4.8 <null>
call System.String System.BitConverter::ToString(System.Byte[],System.Int32,System.Int32)
ldstr -
ldstr 
callvirt System.String System.String::Replace(System.String,System.String)
call System.String System.String::Concat(System.String,System.String)
stloc.1 <null>
leave.s IL_0069: ldc.i4.1
ldloc.2 <null>
brfalse.s IL_0068: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldc.i4.1 <null>
ldloc.1 <null>
ldloca.s V_3
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.s V_4
ldloc.3 <null>
brtrue.s IL_007E: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
call System.Void Nyxos2.Program::BringOtherToFront()
leave.s IL_00A8: ret
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Nyxos2.PatcherForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldloc.s V_4
call System.Void System.GC::KeepAlive(System.Object)
leave.s IL_00A8: ret
ldloc.s V_4
brfalse.s IL_00A7: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ret <null>
Module Name
Nyxos2Patcher.exe
Full Name
Nyxos2Patcher.exe
EntryPoint
System.Void Nyxos2.Program::Main()
Scope Name
Nyxos2Patcher.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nyxos2Patcher
Assembly Version
1.1.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
309
Main Method
System.Void Nyxos2.Program::Main()
Main IL Instruction Count
58
Main IL 
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_BaseDirectory()
ldc.i4.1 <null>
newarr System.Char
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
ldc.i4.s 92
stelem.i2 <null>
ldloc.s V_5
callvirt System.String System.String::TrimEnd(System.Char[])
callvirt System.String System.String::ToLowerInvariant()
stloc.0 <null>
call System.Security.Cryptography.SHA256 System.Security.Cryptography.SHA256::Create()
stloc.2 <null>
ldstr Nyxos2Patcher_
ldloc.2 <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldloc.0 <null>
callvirt System.Byte[] System.Text.Encoding::GetBytes(System.String)
callvirt System.Byte[] System.Security.Cryptography.HashAlgorithm::ComputeHash(System.Byte[])
ldc.i4.0 <null>
ldc.i4.8 <null>
call System.String System.BitConverter::ToString(System.Byte[],System.Int32,System.Int32)
ldstr -
ldstr 
callvirt System.String System.String::Replace(System.String,System.String)
call System.String System.String::Concat(System.String,System.String)
stloc.1 <null>
leave.s IL_0069: ldc.i4.1
ldloc.2 <null>
brfalse.s IL_0068: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldc.i4.1 <null>
ldloc.1 <null>
ldloca.s V_3
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.s V_4
ldloc.3 <null>
brtrue.s IL_007E: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
call System.Void Nyxos2.Program::BringOtherToFront()
leave.s IL_00A8: ret
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Nyxos2.PatcherForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldloc.s V_4
call System.Void System.GC::KeepAlive(System.Object)
leave.s IL_00A8: ret
ldloc.s V_4
brfalse.s IL_00A7: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙