Suspicious
Suspect

0ed68b7b3c352c983fcd4230af19d359

PE Executable
|
MD5: 0ed68b7b3c352c983fcd4230af19d359
|
Size: 2.98 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
0ed68b7b3c352c983fcd4230af19d359
Sha1
b78d629424f7829d9522a5340625dcbdd1a258ee
Sha256
e06cea49c482dd0ddc55cab8fdf5a042540db352139475a8019768481ef152af
Sha384
e85e608d6e8bf56faebae4044cd00e776ca1091e1c921cf4dbd8cc5052c3b66aee598a813cbe04bbee5815b54a6ce6c9
Sha512
4b64f1dda5cdefd59c2821aa2773e87dbabd66629eb77bfb6626984934b10c03d303de417e35352f21c15a734b62cd840d58076c74ac10e20453850a4ec1e264
SSDeep
24576:4hi/qTZh4SbG7T/PefvsluxX/ngo5wMNSeSORl5FEtRI48Y2VB/YFlb4+s/iiMTF:4hiyTZhQXnes8/ngSwjhHsHqSM7K0
TLSH
30D58CCBACE108A9C1E693368AB657927B75FC090B3263D72E50B23C2F727D05935764

PeID

HQR data file
Microsoft Visual C++ v6.0 DLL
Pe123 v2006.4.4-4.12
tElock 1.0 (private) -> tE!
tElock 1.0 (private) -> tE!
File Structure
0ed68b7b3c352c983fcd4230af19d359
[Authenticode]_0a9916e9.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.xdata
.idata
.reloc
.symtab
.rsrc
Resources
CUSTOM
ID:0087
ID:0
ID:0088
ID:0
[Authenticode]_e4177044.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:2052
ZIPRES
ID:0085
ID:0
img
-down.png
-down.png-preview.png
-hover.png
-hover.png-preview.png
-normal.png
-normal.png-preview.png
bkg
default
bkg1.png
bkg1.png-preview.png
bkg2.png
bkg2.png-preview.png
bkg3.png
bkg3.png-preview.png
combo-lang-hot.png
combo-lang-hot.png-preview.png
combo-lang-normal.png
combo-lang-normal.png-preview.png
logo.png
logo.png-preview.png
msgbox_info.png
msgbox_info.png-preview.png
opt-hover.png
opt-hover.png-preview.png
opt-normal.png
opt-normal.png-preview.png
opt-selected-hover.png
opt-selected-hover.png-preview.png
opt-selected-normal.png
opt-selected-normal.png-preview.png
process_light.png
process_light.png-preview.png
x-down.png
x-down.png-preview.png
x-hover.png
x-hover.png-preview.png
x-normal.png
x-normal.png-preview.png
locale
ar.xml
de.xml
en.xml
es.xml
id.xml
ja.xml
ko.xml
pt.xml
ru.xml
th.xml
tr.xml
vi.xml
zh_CN.xml
zh_TW.xml
messagebox.xml
tgbdownloader.xml
RT_ICON
ID:0001
ID:0
RT_MENU
ID:006D
ID:2052
RT_STRING
ID:0007
ID:2052
RT_GROUP_CURSOR4
ID:006B
ID:0
RT_VERSION
ID:0001
ID:2052
RT_MANIFEST
ID:0001
ID:1033
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Authenticode present at 0x2D4400 size 10888 bytes
Artefacts
Name
 Value
URLs in VB Code - #1

http://ocsp.thawte.com0
URLs in VB Code - #2

http://crl.thawte.com/ThawteTimestampingCA.crl0
URLs in VB Code - #3

http://ts-ocsp.ws.symantec.com07
URLs in VB Code - #4

http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
URLs in VB Code - #5

http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
URLs in VB Code - #6

https://www.verisign.com/rpa
URLs in VB Code - #7

http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
URLs in VB Code - #8

https://www.verisign.com/rpa0
URLs in VB Code - #9

http://ocsp.verisign.com0
URLs in VB Code - #10

http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
URLs in VB Code - #11

https://www.verisign.com/cps0
URLs in VB Code - #12

http://logo.verisign.com/vslogo.gif04
URLs in VB Code - #13

http://crl.verisign.com/pca3-g5.crl04
URLs in VB Code - #14

http://schemas.microsoft.com/SMI/2017/WindowsSettings
URLs in VB Code - #15

http://schemas.microsoft.com/SMI/2005/WindowsSettings
URLs in VB Code - #16

http://schemas.microsoft.com/SMI/2016/WindowsSettings
URLs in VB Code - #17

http://crl3.digicert.com/assured-cs-g1.crl00
URLs in VB Code - #18

http://crl4.digicert.com/assured-cs-g1.crl0L
URLs in VB Code - #19

https://www.digicert.com/CPS0
URLs in VB Code - #20

http://ocsp.digicert.com0L
URLs in VB Code - #21

http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
URLs in VB Code - #22

http://www.digicert.com/ssl-cps-repository.htm0
URLs in VB Code - #23

http://ocsp.digicert.com0C
URLs in VB Code - #24

http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
URLs in VB Code - #25

http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
URLs in VB Code - #26

http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
URLs in VB Code - #27

http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
URLs in VB Code - #28

http://crl3.digicert.com/sha2-assured-cs-g1.crl05
URLs in VB Code - #29

http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
URLs in VB Code - #30

http://ocsp.digicert.com0N
URLs in VB Code - #31

http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
URLs in VB Code - #32

http://www.digicert.com/CPS0
URLs in VB Code - #33

http://crl3.digicert.com/sha2-assured-ts.crl02
URLs in VB Code - #34

http://crl4.digicert.com/sha2-assured-ts.crl0
URLs in VB Code - #35

http://ocsp.digicert.com0O
URLs in VB Code - #36

http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
URLs in VB Code - #37

http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
0ed68b7b3c352c983fcd4230af19d359 (2.98 MB)
File Structure
0ed68b7b3c352c983fcd4230af19d359
[Authenticode]_0a9916e9.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.xdata
.idata
.reloc
.symtab
.rsrc
Resources
CUSTOM
ID:0087
ID:0
ID:0088
ID:0
[Authenticode]_e4177044.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:2052
ZIPRES
ID:0085
ID:0
img
-down.png
-down.png-preview.png
-hover.png
-hover.png-preview.png
-normal.png
-normal.png-preview.png
bkg
default
bkg1.png
bkg1.png-preview.png
bkg2.png
bkg2.png-preview.png
bkg3.png
bkg3.png-preview.png
combo-lang-hot.png
combo-lang-hot.png-preview.png
combo-lang-normal.png
combo-lang-normal.png-preview.png
logo.png
logo.png-preview.png
msgbox_info.png
msgbox_info.png-preview.png
opt-hover.png
opt-hover.png-preview.png
opt-normal.png
opt-normal.png-preview.png
opt-selected-hover.png
opt-selected-hover.png-preview.png
opt-selected-normal.png
opt-selected-normal.png-preview.png
process_light.png
process_light.png-preview.png
x-down.png
x-down.png-preview.png
x-hover.png
x-hover.png-preview.png
x-normal.png
x-normal.png-preview.png
locale
ar.xml
de.xml
en.xml
es.xml
id.xml
ja.xml
ko.xml
pt.xml
ru.xml
th.xml
tr.xml
vi.xml
zh_CN.xml
zh_TW.xml
messagebox.xml
tgbdownloader.xml
RT_ICON
ID:0001
ID:0
RT_MENU
ID:006D
ID:2052
RT_STRING
ID:0007
ID:2052
RT_GROUP_CURSOR4
ID:006B
ID:0
RT_VERSION
ID:0001
ID:2052
RT_MANIFEST
ID:0001
ID:1033
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
URLs in VB Code - #1

http://ocsp.thawte.com0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #2

http://crl.thawte.com/ThawteTimestampingCA.crl0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #3

http://ts-ocsp.ws.symantec.com07

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #4

http://ts-aia.ws.symantec.com/tss-ca-g2.cer0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #5

http://ts-crl.ws.symantec.com/tss-ca-g2.crl0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #6

https://www.verisign.com/rpa

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #7

http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #8

https://www.verisign.com/rpa0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #9

http://ocsp.verisign.com0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #10

http://csc3-2010-aia.verisign.com/CSC3-2010.cer0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #11

https://www.verisign.com/cps0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #12

http://logo.verisign.com/vslogo.gif04

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #13

http://crl.verisign.com/pca3-g5.crl04

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #14

http://schemas.microsoft.com/SMI/2017/WindowsSettings

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #15

http://schemas.microsoft.com/SMI/2005/WindowsSettings

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #16

http://schemas.microsoft.com/SMI/2016/WindowsSettings

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #17

http://crl3.digicert.com/assured-cs-g1.crl00

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #18

http://crl4.digicert.com/assured-cs-g1.crl0L

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #19

https://www.digicert.com/CPS0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #20

http://ocsp.digicert.com0L

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #21

http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #22

http://www.digicert.com/ssl-cps-repository.htm0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #23

http://ocsp.digicert.com0C

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #24

http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #25

http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #26

http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #27

http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #28

http://crl3.digicert.com/sha2-assured-cs-g1.crl05

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #29

http://crl4.digicert.com/sha2-assured-cs-g1.crl0L

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #30

http://ocsp.digicert.com0N

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #31

http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #32

http://www.digicert.com/CPS0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #33

http://crl3.digicert.com/sha2-assured-ts.crl02

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #34

http://crl4.digicert.com/sha2-assured-ts.crl0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #35

http://ocsp.digicert.com0O

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #36

http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0

0ed68b7b3c352c983fcd4230af19d359
URLs in VB Code - #37

http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P

0ed68b7b3c352c983fcd4230af19d359
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙