Deep Malware Analysis of 0cd74763c8271e198bd5d3bcc2a3bb1e | md5: 0cd74763c8271e198bd5d3bcc2a3bb1e | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64 | PDB Path | Managed .NET | .Net | SOS: 0.21 | SOS: 0.20 | SOS: 0.92

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	0cd74763c8271e198bd5d3bcc2a3bb1e
Sha1	0c7481ffcf1ceee98e3500c552cec40c6d7d8fbe
Sha256	8f9a5a5bda7dc3faf1d5cb74f0b4dc63643ab3bb205f119e585c5f290adc9137
Sha384	55d61dd840ddc3b9d9b63520c3ee491e3a5f4a4df6ba5bee597d1ab2ce711f933e686d795460eb7de2f31fa8023e12f0
Sha512	1f81be7e0b49b6ee0968d85750bb57c0e49767b2d3c9347efe6f0ba8dc1893ff1d086c252e27760d58b4060d801c21c25ae8db60d504673f1f966b39470bf500
SSDeep	98304:rKAoxUZKdU9yaNCil45SMCn1+DoF3mncXMB8/rM2wH1eRm:rAxbU9yaLCEZnkDoFWn9sZwsM
TLSH	F2362346A7A430FCE062D9748945CB01F3357C89AB70DAAB27D8FA672F63140D92D736

PeID

Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikon

0cd74763c8271e198bd5d3bcc2a3bb1e

Executable

PE (Portable Executable)

Overlay_ed21e535.bin

PE (Portable Executable)

OpenLink.ps1

ae_mixtwo.exe

PE (Portable Executable)

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

RT_MANIFEST

ID:0001

ID:0

.Net Resources

HomagConnect.ProductionManager.Contracts.Orders.OrderActionDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Orders.UsageDetailsPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Orders.UsageOverviewPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemFeedbackActionDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemFeedbackDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemStatusDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemTypeDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionProtocol.ProcessedItemCategoryDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionProtocol.ProductionProtocolPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkCategoryDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkReasonDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkStateDisplayNames.resources

HomagConnect.ProductionManager.Contracts.WorkstationYield.WorkstationYieldPropertyNames.resources

LfdReader.dll

Executable

PE (Portable Executable)

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.reloc

.rsrc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

IBar2Double&&

LX_Naspb0sNo0zyrCb.zip

Zip Archive

Executable

PE (Portable Executable)

re21.exe

PE (Portable Executable)

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rsrc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

ILRepack.List

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

.didat

.fptable

.rsrc

.reloc

Resources

PNG

ID:0065

ID:1033

ID:1033-preview.png

ID:0066

ID:1033

ID:1033-preview.png

RT_ICON

ID:0001

ID:1033

ID:0002

ID:1033

ID:0003

ID:1033

ID:0004

ID:1033

ID:0005

ID:1033

ID:0006

ID:1033

ID:0007

ID:1033

ID:1033-preview.png

RT_DIALOG

ID:0000

ID:1033

RT_STRING

ID:0007

ID:1033

ID:0008

ID:1033

ID:0009

ID:1033

ID:000A

ID:1033

ID:000B

ID:1033

ID:000C

ID:1033

ID:000D

ID:1033

ID:000E

ID:1033

ID:000F

ID:1033

ID:0010

ID:1033

ID:0011

ID:1033

RT_GROUP_CURSOR4

ID:0064

ID:1033

RT_MANIFEST

ID:0001

ID:1033

STICH beta

No STICH Path has been generated for this analysis yet.

9 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 8img 1

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Overlay extracted: Overlay_ed21e535.bin (4387617 bytes)
Info	PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb