Suspicious
Suspect

0b1f39ab213fd828465245a0c93f7ac4

PE Executable
|
MD5: 0b1f39ab213fd828465245a0c93f7ac4
|
Size: 1.99 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
0b1f39ab213fd828465245a0c93f7ac4
Sha1
ce7495edb009e6fb31497b929930d85d2f275073
Sha256
87dcec6f3a6e66df8a64c73f866c039f97aae2bdaf1018297033327c4df42de1
Sha384
7adc1daaddf7063b7da57f1b6798cbae610f71585fb59ef045897a767e9af1855394da65479b53cd154f125662a351b9
Sha512
77d818fb49590baf5ec98ba908ce99866370c4f481f929ae34c1a3853fd3043913bb7e0d5e246c283d1bbfaa6ee140b94f29f3b22d78705bdc808632fe6b255f
SSDeep
24576:UKI7wSAySJKqyW6paAWPBF7JVV4mkZEAb+o/:teZEAbr/
TLSH
E195B5226DC18C528B760C3A7E397C01AA38D9B7114D6DE970DD3A5F2EB3C644AF3592

PeID

Microsoft Visual C++ v6.0 DLL
File Structure
0b1f39ab213fd828465245a0c93f7ac4
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.tls2
.rsrc
.reloc
Resources
RT_RCDATA
ID:0339
ID:1033
ID:0362
ID:1033
RT_VERSION
ID:0001
ID:1033
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Artefacts
Name
 Value
URLs in VB Code - #1

https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/stricmp-wcsicmp-mbsicmp-stricmp-l-wcsicmp-l-mbsicmp-l?view=msvc-170
URLs in VB Code - #2

https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/stricmp-wcsicmp?view=msvc-170
URLs in VB Code - #3

https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/strcmpi?view=msvc-170
URLs in VB Code - #4

https://docs.microsoft.com/en-us/windows/win32/api/versionhelpers/
URLs in VB Code - #5

https://docs.microsoft.com/en-us/cpp/intrinsics/noop
URLs in VB Code - #6

https://docs.microsoft.com/en-us/cpp/intrinsics/nop
URLs in VB Code - #7

https://msdn.microsoft.com/en-us/library/windows/desktop/dd542643(v=vs.85).aspx
URLs in VB Code - #8

https://msdn.microsoft.com/en-us/library/windows/desktop/dd542647(v=vs.85).aspx
URLs in VB Code - #9

https://msdn.microsoft.com/en-us/library/windows/desktop/dd542648(v=vs.85).aspx
URLs in VB Code - #10

https://msdn.microsoft.com/en-us/library/windows/desktop/dd542645(v=vs.85).aspx
URLs in VB Code - #11

https://msdn.microsoft.com/en-us/library/windows/desktop/dd542646(v=vs.85).aspx
URLs in VB Code - #12

https://msdn.microsoft.com/en-us/library/windows/desktop/dd542649(v=vs.85).aspx
URLs in VB Code - #13

https://msdn.microsoft.com/en-us/library/windows/desktop/dd542650(v=vs.85).aspx
URLs in VB Code - #14

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681382(v=vs.85).aspx
URLs in VB Code - #15

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681388(v=vs.85).aspx
URLs in VB Code - #16

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681383(v=vs.85).aspx
URLs in VB Code - #17

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681385(v=vs.85).aspx
URLs in VB Code - #18

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681386(v=vs.85).aspx
URLs in VB Code - #19

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681387(v=vs.85).aspx
URLs in VB Code - #20

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681389(v=vs.85).aspx
URLs in VB Code - #21

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681390(v=vs.85).aspx
URLs in VB Code - #22

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681391(v=vs.85).aspx
URLs in VB Code - #23

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681384(v=vs.85).aspx
URLs in VB Code - #24

https://msdn.microsoft.com/en-us/library/windows/desktop/aa385465(v=vs.85).aspx
URLs in VB Code - #25

https://docs.microsoft.com/en-us/windows/win32/api/winnt/nf-winnt-text
URLs in VB Code - #26

https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getsyscolor
URLs in VB Code - #27

https://docs.microsoft.com/en-us/windows/console/char-info-str
URLs in VB Code - #28

https://learn.microsoft.com/en-us/cpp/build/reference/entry-entry-point-symbol
0b1f39ab213fd828465245a0c93f7ac4 (1.99 MB)
File Structure
0b1f39ab213fd828465245a0c93f7ac4
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.tls2
.rsrc
.reloc
Resources
RT_RCDATA
ID:0339
ID:1033
ID:0362
ID:1033
RT_VERSION
ID:0001
ID:1033
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
URLs in VB Code - #1

https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/stricmp-wcsicmp-mbsicmp-stricmp-l-wcsicmp-l-mbsicmp-l?view=msvc-170

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #2

https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/stricmp-wcsicmp?view=msvc-170

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #3

https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/strcmpi?view=msvc-170

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #4

https://docs.microsoft.com/en-us/windows/win32/api/versionhelpers/

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #5

https://docs.microsoft.com/en-us/cpp/intrinsics/noop

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #6

https://docs.microsoft.com/en-us/cpp/intrinsics/nop

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #7

https://msdn.microsoft.com/en-us/library/windows/desktop/dd542643(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #8

https://msdn.microsoft.com/en-us/library/windows/desktop/dd542647(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #9

https://msdn.microsoft.com/en-us/library/windows/desktop/dd542648(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #10

https://msdn.microsoft.com/en-us/library/windows/desktop/dd542645(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #11

https://msdn.microsoft.com/en-us/library/windows/desktop/dd542646(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #12

https://msdn.microsoft.com/en-us/library/windows/desktop/dd542649(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #13

https://msdn.microsoft.com/en-us/library/windows/desktop/dd542650(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #14

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681382(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #15

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681388(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #16

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681383(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #17

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681385(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #18

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681386(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #19

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681387(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #20

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681389(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #21

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681390(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #22

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681391(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #23

https://msdn.microsoft.com/en-us/library/windows/desktop/ms681384(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #24

https://msdn.microsoft.com/en-us/library/windows/desktop/aa385465(v=vs.85).aspx

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #25

https://docs.microsoft.com/en-us/windows/win32/api/winnt/nf-winnt-text

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #26

https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getsyscolor

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #27

https://docs.microsoft.com/en-us/windows/console/char-info-str

0b1f39ab213fd828465245a0c93f7ac4
URLs in VB Code - #28

https://learn.microsoft.com/en-us/cpp/build/reference/entry-entry-point-symbol

0b1f39ab213fd828465245a0c93f7ac4
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙