Deep Malware Analysis of 0054d2622e335797a8697982af417982 | md5: 0054d2622e335797a8697982af417982 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64 | PDB Path | Managed .NET | .Net | SOS: 0.21 | SOS: 0.20 | SOS: 0.92

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	0054d2622e335797a8697982af417982
Sha1	863adf6289db25fdc4ac0ef2e1a2ae63d43366b9
Sha256	86f27425624e99fca1a6735b4ed5e192f575794e57f16c47a1e068bb1e608d6a
Sha384	edfa341d95c18ea19ccd2f1f66771bf95d1450a70fa830f2090373b56a63b76ca5da42861cd77fe0fe9d7f611de50518
Sha512	e733e48c94bae8f2432b86999eb30cbf2fa629dada22d945a215d5652dddfad0f060260db378a3dc029b34ba1702b640f7cb468368547d2b9f1824ee89b4ceac
SSDeep	393216:Psr//yRj3zzD2I8Pm0eBkXnZAKcQYFh2kvvJYxXxSyXK+o:P9Rj3zGI8kBONcXh2a6PXJo
TLSH	C5F63305A76031ABFCB29134DFE786D0DB72780B072495EB27E4A95B1FA71D1CB2A710

PeID

Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikon

0054d2622e335797a8697982af417982

Executable

PE (Portable Executable)

Overlay_78cc8633.bin

PE (Portable Executable)

OpenLink.ps1

ae_mixtwo.exe

PE (Portable Executable)

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

RT_MANIFEST

ID:0001

ID:0

.Net Resources

HomagConnect.ProductionManager.Contracts.Orders.OrderActionDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Orders.UsageDetailsPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Orders.UsageOverviewPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemFeedbackActionDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemFeedbackDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemStatusDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemTypeDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionProtocol.ProcessedItemCategoryDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionProtocol.ProductionProtocolPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkCategoryDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkReasonDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkStateDisplayNames.resources

HomagConnect.ProductionManager.Contracts.WorkstationYield.WorkstationYieldPropertyNames.resources

LfdReader.dll

Executable

PE (Portable Executable)

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.reloc

.rsrc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

IBar2Double&&

LX_Naspb0sNo0zyrCb.zip

Zip Archive

Executable

PE (Portable Executable)

re21.exe

PE (Portable Executable)

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rsrc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

ILRepack.List

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

.didat

.fptable

.rsrc

.reloc

Resources

PNG

ID:0065

ID:1033

ID:1033-preview.png

ID:0066

ID:1033

ID:1033-preview.png

RT_ICON

ID:0001

ID:1033

ID:0002

ID:1033

ID:0003

ID:1033

ID:0004

ID:1033

ID:0005

ID:1033

ID:0006

ID:1033

ID:0007

ID:1033

ID:1033-preview.png

RT_DIALOG

ID:0000

ID:1033

RT_STRING

ID:0007

ID:1033

ID:0008

ID:1033

ID:0009

ID:1033

ID:000A

ID:1033

ID:000B

ID:1033

ID:000C

ID:1033

ID:000D

ID:1033

ID:000E

ID:1033

ID:000F

ID:1033

ID:0010

ID:1033

ID:0011

ID:1033

RT_GROUP_CURSOR4

ID:0064

ID:1033

RT_MANIFEST

ID:0001

ID:1033

STICH beta

No STICH Path has been generated for this analysis yet.

9 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 8img 1

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Overlay extracted: Overlay_78cc8633.bin (15165561 bytes)
Info	PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb