Deep Malware Analysis of eed11bfc65801c82e95028c89f63e711 | md5: eed11bfc65801c82e95028c89f63e711 | .Net | PE (Portable Executable) | SOS: 0.76 | .Net Obfuscator | .Net Reactor | Executable | Managed .NET | PE File Layout | Win 32 Exe | x86

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score High

MD5	eed11bfc65801c82e95028c89f63e711
Sha1	a0c08231bd393f8c1302defb6307fe240b21cbc7
Sha256	65528e4223570e3286739396fa918a431b4d6fd9860dd9d913a0b2adaf1ab3be
Sha384	5f1469932888eee7fbf525a53c6ebef246cd0f93b321bbdbbecb883dc0c7a9ab240e676b0694e396b023909e71aa00f6
Sha512	8103c626ea59acb2897244a4cdd625de1269d8aaee0801fd382e19d6689237c7ad2fc37fea375a6558d6052cfc8b6df9680f02210bf5110ad17a1e245f1a1a36
SSDeep	24576:Og9kBap6vkIztc8RaZUrvXBRf/LtdI2LO9NEJqrwUNqHzW0NzaDn:OmsVz28RaZ4nxdRsyw7NqTWa
TLSH	6485F17C3123ED8ED6428A358950DE7882206E594616E213F6D73FAF7D3E18F9D142A3

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	YgBe.exe
Full Name	YgBe.exe
EntryPoint	System.Void r4.NI::op()
Scope Name	YgBe.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	YgBe
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	0
Main Method	System.Void r4.NI::op()
Main IL Instruction Count	40
Main IL	br.s IL_004C: call System.Void r4.NI::‭‌‮⁬⁮‎‭⁫⁬‌‫⁮⁪⁫⁪‏⁬‎⁯⁬⁮⁬⁫⁪‫⁫‎⁫‌‌‬⁯‏‎⁮⁭‌‏‮() ldc.i4 1055164632 ldc.i4 524723467 xor <null> dup <null> stloc.0 <null> ldc.i4.s 9 rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_009F: br.s IL_006F ldloc.0 <null> ldc.i4 1648410785 mul <null> ldc.i4 350898910 xor <null> br.s IL_0007: ldc.i4 524723467 call System.Void r4.NI::‭‌‮⁬⁮‎‭⁫⁬‌‫⁮⁪⁫⁪‏⁬‎⁯⁬⁮⁬⁫⁪‫⁫‎⁫‌‌‬⁯‏‎⁮⁭‌‏‮() ldc.i4 1616018663 br.s IL_0007: ldc.i4 524723467 ldloc.0 <null> ldc.i4 -1584295333 mul <null> ldc.i4 1574444645 xor <null> br.s IL_0007: ldc.i4 524723467 ret <null> ldc.i4 346270449 br.s IL_0007: ldc.i4 524723467 ldc.i4.0 <null> call System.Void r4.NI::‏⁯‪⁫⁭⁪‮‫‮‏‌‬⁫‬⁬‪‫⁭‫⁭‬⁯‭‪‏⁪‏‍⁯⁯‫⁭⁭‮⁫‬‎‮(System.Boolean) ldc.i4 346270449 br.s IL_0007: ldc.i4 524723467 newobj System.Void Xso.VsF::.ctor() call System.Void r4.NI::⁭‏⁯⁫‍‪‪‏‭⁭‎⁭‭‮‭⁫‌⁯⁯⁭‪⁯‌‏‏‎‬‍‫⁮⁪‏‬‮‫‮‎⁭‮(System.Windows.Forms.Form) ldc.i4 1607741034 br IL_0007: ldc.i4 524723467 call System.Void Ned.VeC::z00() ldc.i4 1977817208 br IL_0007: ldc.i4 524723467 br.s IL_006F: ldc.i4.0
Info	PE Detect: PeReader OK (file layout)
Module Name	YgBe.exe
Full Name	YgBe.exe
EntryPoint	System.Void r4.NI::op()
Scope Name	YgBe.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	YgBe
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	0
Main Method	System.Void r4.NI::op()
Main IL Instruction Count	40
Main IL	br.s IL_004C: call System.Void r4.NI::‭‌‮⁬⁮‎‭⁫⁬‌‫⁮⁪⁫⁪‏⁬‎⁯⁬⁮⁬⁫⁪‫⁫‎⁫‌‌‬⁯‏‎⁮⁭‌‏‮() ldc.i4 1055164632 ldc.i4 524723467 xor <null> dup <null> stloc.0 <null> ldc.i4.s 9 rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_009F: br.s IL_006F ldloc.0 <null> ldc.i4 1648410785 mul <null> ldc.i4 350898910 xor <null> br.s IL_0007: ldc.i4 524723467 call System.Void r4.NI::‭‌‮⁬⁮‎‭⁫⁬‌‫⁮⁪⁫⁪‏⁬‎⁯⁬⁮⁬⁫⁪‫⁫‎⁫‌‌‬⁯‏‎⁮⁭‌‏‮() ldc.i4 1616018663 br.s IL_0007: ldc.i4 524723467 ldloc.0 <null> ldc.i4 -1584295333 mul <null> ldc.i4 1574444645 xor <null> br.s IL_0007: ldc.i4 524723467 ret <null> ldc.i4 346270449 br.s IL_0007: ldc.i4 524723467 ldc.i4.0 <null> call System.Void r4.NI::‏⁯‪⁫⁭⁪‮‫‮‏‌‬⁫‬⁬‪‫⁭‫⁭‬⁯‭‪‏⁪‏‍⁯⁯‫⁭⁭‮⁫‬‎‮(System.Boolean) ldc.i4 346270449 br.s IL_0007: ldc.i4 524723467 newobj System.Void Xso.VsF::.ctor() call System.Void r4.NI::⁭‏⁯⁫‍‪‪‏‭⁭‎⁭‭‮‭⁫‌⁯⁯⁭‪⁯‌‏‏‎‬‍‫⁮⁪‏‬‮‫‮‎⁭‮(System.Windows.Forms.Form) ldc.i4 1607741034 br IL_0007: ldc.i4 524723467 call System.Void Ned.VeC::z00() ldc.i4 1977817208 br IL_0007: ldc.i4 524723467 br.s IL_006F: ldc.i4.0