Deep Malware Analysis of f0227e480e845b98b91e385b898e9b47 | md5: f0227e480e845b98b91e385b898e9b47 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.69

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

1.15 MB · 1,150,976 B

First seen

2026-08-13 11:02 · 2 months ago

Last seen

2026-08-13 11:02 · 2 months ago

Last analysis

2026-08-13 11:02 · 2 months ago

Hashes

MD5 f0227e480e845b98b91e385b898e9b47 Sha1 3bb888cb49563f907b4b1305cd3c6a1eff227a5a Sha256 c9548996fd7c80f449b61ab4706dce3d35307aa7215c8ff82788a513d6789e2d Sha384 af18ac05c772bfa844299a0b43e3923c847d77b3911bc370f3e374acd7fef5a4c5491f593b1702b35c52a1c208f9b7ea Sha512 b8c892d39f00a01d02091fb3fe8d0bb9bfdb36134d6c66014ac6f117e4ee0d428988e82f541a778ce7889619530d4185794457a2b19e20e8941ccd25c4dc8ad0 SSDeep 24576:PW5RjWbeiKShG9Oq43UhD9ntuo0rBE8RBCRR:8IhG9OHUhDx4rlEiBCR TLSH A635EF042217CB33C5166AB5C9B3D3F806A05E84E911C23F6AE97EBB7F75F751984282

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

High

22 files

EXEf0227e480e845b98b91e385b898e9b47

Structure

BINResources

BIN.Net Resources

STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	NyeS.exe
Full Name	NyeS.exe
EntryPoint	System.Void Xp.b3::Oy()
Scope Name	NyeS.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	NyeS
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	323
Main Method	System.Void Xp.b3::Oy()
Main IL Instruction Count	20
Main IL	br IL_0013: nop nop <null> ret <null> nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_001E: call System.Void cxC.uxW::vRb() nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_0007: nop call System.Void cxC.uxW::vRb() br IL_0039: nop ldloc.s V_0 newobj System.Void VV.Wa::.ctor(XK.vs) call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0005: nop nop <null> newobj System.Void XK.vs::.ctor() stloc.s V_0 br IL_0028: ldloc.s V_0
Module Name	NyeS.exe
Full Name	NyeS.exe
EntryPoint	System.Void Xp.b3::Oy()
Scope Name	NyeS.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	NyeS
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	323
Main Method	System.Void Xp.b3::Oy()
Main IL Instruction Count	20
Main IL	br IL_0013: nop nop <null> ret <null> nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_001E: call System.Void cxC.uxW::vRb() nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_0007: nop call System.Void cxC.uxW::vRb() br IL_0039: nop ldloc.s V_0 newobj System.Void VV.Wa::.ctor(XK.vs) call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0005: nop nop <null> newobj System.Void XK.vs::.ctor() stloc.s V_0 br IL_0028: ldloc.s V_0