Suspicious
Suspect

0e08fe8da2df31c5133c6803697db6cb

PE Executable
|
MD5: 0e08fe8da2df31c5133c6803697db6cb
|
Size: 6.68 MB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
0e08fe8da2df31c5133c6803697db6cb
Sha1
8a5ad5e836ecd8db32be25166fdeb6a90331db26
Sha256
e66b89e5ba1662f055f9030c10af9cdb366eb72ffa893013ffb33ddafc2baa01
Sha384
1e05d2a90f0252a7698f44ac1cb558d0ea3b0eb42bbdae44925589229234db587274d684ea2b4b0a273a6358296f9482
Sha512
cc0abeba6f3beb4893608e80dd25ceb1e99fa90069dc89b02945e249b28f7d6317bbf9f6e6ead37e93a92ddf9305722f1bfe0a1be202f759d144a0c26d787e7d
SSDeep
98304:9zsmPeG+yhB0DhlL3Yi0x915FZLp9fj0pEd+2MiV+Uyg:hsPyhB5i0x99tpFel8Fy
TLSH
DD66AF11AFC54DB7CA23EB3C1916A06CB09E9C2417B5C3E3DADFBDEA1C344424968766

PeID

Microsoft Visual C++ 6.0 DLL (Debug)
Microsoft Visual C++ 7.0 - 8.0
Microsoft Visual C++ v6.0 DLL
UPolyX 0.3 -> delikon
File Structure
0e08fe8da2df31c5133c6803697db6cb
[Authenticode]_94bd61c8.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.tlc
.rdata
.data
.gfids
.giats
.tls
.tls0
.rsrc
.reloc
Resources
COUNTDOWN
ID:0FAE
ID:2052
QBARDETV1
ID:0FAF
ID:2052
QBARSEGV2
ID:0FB0
ID:2052
QBARSRV3
ID:0FB1
ID:2052
QMP_DSD
ID:0FAC
ID:2052
QMP_UNRAR
ID:0FAB
ID:2052
QMP_WAVPACK
ID:0FAA
ID:2052
RT_CURSOR
ID:0002
ID:2052
ID:0003
ID:2052
ID:0004
ID:2052
ID:0005
ID:2052
ID:0006
ID:2052
ID:0007
ID:2052
ID:0008
ID:2052
ID:0009
ID:2052
ID:000A
ID:2052
ID:000B
ID:2052
ID:000C
ID:2052
ID:000D
ID:2052
ID:000E
ID:2052
ID:000F
ID:2052
ID:0010
ID:2052
ID:0011
ID:2052
RT_BITMAP
ID:7912
ID:2052
ID:7914
ID:2052
RT_ICON
ID:0001
ID:2052
RT_DIALOG
ID:0FA1
ID:2052
ID:7801
ID:2052
ID:780E
ID:2052
RT_STRING
ID:0F01
ID:2052
ID:0F02
ID:2052
ID:0F03
ID:2052
ID:0F11
ID:2052
ID:0F12
ID:2052
ID:0F13
ID:2052
ID:0F14
ID:2052
ID:0F19
ID:2052
ID:0F1A
ID:2052
ID:0F1B
ID:2052
ID:0F1C
ID:2052
ID:0F1D
ID:2052
ID:0F2F
ID:2052
RT_GROUP_CURSOR2
ID:7901
ID:2052
ID:7916
ID:2052
ID:7917
ID:2052
ID:7918
ID:2052
ID:7919
ID:2052
ID:791A
ID:2052
ID:791B
ID:2052
ID:791C
ID:2052
ID:791D
ID:2052
ID:791E
ID:2052
ID:791F
ID:2052
ID:7920
ID:2052
ID:7921
ID:2052
ID:7922
ID:2052
ID:7923
ID:2052
RT_GROUP_CURSOR4
ID:0FAD
ID:2052
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Authenticode present at 0x65BA00 size 11712 bytes
Info

PDB Path: F:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\Uninstall WeiyunApp\Release\Uninstall WeiyunApp.pdb
Artefacts
Name
 Value
URLs in VB Code - #1

http://ocsp.digicert.com0C
URLs in VB Code - #2

http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
URLs in VB Code - #3

http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
URLs in VB Code - #4

http://ocsp.digicert.com0A
URLs in VB Code - #5

http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
URLs in VB Code - #6

http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
URLs in VB Code - #7

http://ocsp.digicert.com0
URLs in VB Code - #8

http://cacerts.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crt0_
URLs in VB Code - #9

http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl0
URLs in VB Code - #10

http://www.digicert.com/CPS0
URLs in VB Code - #11

http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
URLs in VB Code - #12

http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
URLs in VB Code - #13

http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
0e08fe8da2df31c5133c6803697db6cb (6.68 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙