Malicious
Malicious

eed11bfc65801c82e95028c89f63e711

PE Executable
MD5: eed11bfc65801c82e95028c89f63e711
Size: 1.79 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.79 MB · 1,791,488 B
First seen
2026-09-04 20:30 · one month ago
Last seen
2026-09-04 20:30 · one month ago
Last analysis
2026-09-04 20:31 · one month ago
Hashes
MD5 eed11bfc65801c82e95028c89f63e711 Sha1 a0c08231bd393f8c1302defb6307fe240b21cbc7 Sha256 65528e4223570e3286739396fa918a431b4d6fd9860dd9d913a0b2adaf1ab3be Sha384 5f1469932888eee7fbf525a53c6ebef246cd0f93b321bbdbbecb883dc0c7a9ab240e676b0694e396b023909e71aa00f6 Sha512 8103c626ea59acb2897244a4cdd625de1269d8aaee0801fd382e19d6689237c7ad2fc37fea375a6558d6052cfc8b6df9680f02210bf5110ad17a1e245f1a1a36 SSDeep 24576:Og9kBap6vkIztc8RaZUrvXBRf/LtdI2LO9NEJqrwUNqHzW0NzaDn:OmsVz28RaZ4nxdRsyw7NqTWa TLSH 6485F17C3123ED8ED6428A358950DE7882206E594616E213F6D73FAF7D3E18F9D142A3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
Symbol obfuscation
High
1 malicious · 23 files
EXEeed11bfc65801c82e95028c89f63e711
Structure
BIN.Net Resources
BINYgBe.g.resources
BINSoftwareRenderer.Properties.Resources.resources
BINTK
DATA[NBF]root.Data
BINIfWr
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINprogressBar1.Modifiers
BIN$this.Language
BIN$this.GridSize
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
YgBe.exe
Full Name
YgBe.exe
EntryPoint
System.Void r4.NI::op()
Scope Name
YgBe.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
YgBe
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
0
Main Method
System.Void r4.NI::op()
Main IL Instruction Count
40
Main IL 
br.s IL_004C: call System.Void r4.NI::‭‌‮‎‭‌‫‏‎‫‎‌​‌‬‏​‎‌‏‮()
ldc.i4 1055164632
ldc.i4 524723467
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.s 9
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_009F: br.s IL_006F
ldloc.0 <null>
ldc.i4 1648410785
mul <null>
ldc.i4 350898910
xor <null>
br.s IL_0007: ldc.i4 524723467
call System.Void r4.NI::‭‌‮‎‭‌‫‏‎‫‎‌​‌‬‏​‎‌‏‮()
ldc.i4 1616018663
br.s IL_0007: ldc.i4 524723467
ldloc.0 <null>
ldc.i4 -1584295333
mul <null>
ldc.i4 1574444645
xor <null>
br.s IL_0007: ldc.i4 524723467
ret <null>
ldc.i4 346270449
br.s IL_0007: ldc.i4 524723467
ldc.i4.0 <null>
call System.Void r4.NI::‏‪‮‫‮‏‌‬‬‪‫‫‬‭‪‏‏‍​​​‫‮‬‎‮(System.Boolean)
ldc.i4 346270449
br.s IL_0007: ldc.i4 524723467
newobj System.Void Xso.VsF::.ctor()
call System.Void r4.NI::‏‍​‪‪‏‭‎‭‮‭‌‪‌‏‏‎‬‍‫‏‬‮‫‮​‎‮(System.Windows.Forms.Form)
ldc.i4 1607741034
br IL_0007: ldc.i4 524723467
call System.Void Ned.VeC::z00()
ldc.i4 1977817208
br IL_0007: ldc.i4 524723467
br.s IL_006F: ldc.i4.0
Module Name
YgBe.exe
Full Name
YgBe.exe
EntryPoint
System.Void r4.NI::op()
Scope Name
YgBe.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
YgBe
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
0
Main Method
System.Void r4.NI::op()
Main IL Instruction Count
40
Main IL 
br.s IL_004C: call System.Void r4.NI::‭‌‮‎‭‌‫‏‎‫‎‌​‌‬‏​‎‌‏‮()
ldc.i4 1055164632
ldc.i4 524723467
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.s 9
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_009F: br.s IL_006F
ldloc.0 <null>
ldc.i4 1648410785
mul <null>
ldc.i4 350898910
xor <null>
br.s IL_0007: ldc.i4 524723467
call System.Void r4.NI::‭‌‮‎‭‌‫‏‎‫‎‌​‌‬‏​‎‌‏‮()
ldc.i4 1616018663
br.s IL_0007: ldc.i4 524723467
ldloc.0 <null>
ldc.i4 -1584295333
mul <null>
ldc.i4 1574444645
xor <null>
br.s IL_0007: ldc.i4 524723467
ret <null>
ldc.i4 346270449
br.s IL_0007: ldc.i4 524723467
ldc.i4.0 <null>
call System.Void r4.NI::‏‪‮‫‮‏‌‬‬‪‫‫‬‭‪‏‏‍​​​‫‮‬‎‮(System.Boolean)
ldc.i4 346270449
br.s IL_0007: ldc.i4 524723467
newobj System.Void Xso.VsF::.ctor()
call System.Void r4.NI::‏‍​‪‪‏‭‎‭‮‭‌‪‌‏‏‎‬‍‫‏‬‮‫‮​‎‮(System.Windows.Forms.Form)
ldc.i4 1607741034
br IL_0007: ldc.i4 524723467
call System.Void Ned.VeC::z00()
ldc.i4 1977817208
br IL_0007: ldc.i4 524723467
br.s IL_006F: ldc.i4.0
1 malicious · 23 files
EXEeed11bfc65801c82e95028c89f63e711
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙