Suspicious
Suspect

18a5ac918c8adaefb3ae6c93d802cb19

Share on LinkedIn
Print
PE Executable
MD5: 18a5ac918c8adaefb3ae6c93d802cb19
Size: 16.79 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 18a5ac918c8adaefb3ae6c93d802cb19
Sha1 66223509d0083fbd05b5156f19f5ef85689187b9
Sha256 d74ae7334478a9adb119a68fc56d43b3d314a63d4ebdd3308e4ea5c91c333fb1
Sha384 527ef32d10bc1939bdd2ad9efd775d3233fab75b616251cdce77b4826bb880c7156fcf4534487e6644af9a38d976ebcf
Sha512 b334ecb240bc06e04078762701aad1a950ae2f6791bc71567b2fa37252c222d21852416aa1937ae1aef2032bf08e5de9fc0e245aeb7467cec0a0a214236a5133
SSDeep 196608:n8jd3I7FpsVOFroRCZpHo+fRz0Uef0V9/gdvzf5VsswAUzvHBv64Alde63AACc:U3I7gVOFrHtNyMV9/SzhoAyBC4aDX
TLSH 2C073337F268913FD5AA0B3209B39150993BBE606A098C9F03FC394DCF765611E3B55A
PeID
Armadillo v4.xMASM/TASM - sig4 (h)Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12Private EXE Protector V2.30-V2.3X -> SetiSoft TeamVC8 -> Microsoft Corporation
18a5ac918c8adaefb3ae6c93d802cb19
[Authenticode]_25e406c6.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
AFX_DIALOG_LAYOUT
ID:0065
ID:1049
EXE
ID:0066
ID:1033
[Authenticode]_3e20325a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.itext
.data
.bss
.idata
.didata
.edata
.tls
.rdata
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:1033-preview.png
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
RT_STRING
ID:0FF6
ID:0
ID:0FF7
ID:0
ID:0FF8
ID:0
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFC
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
ID:1000
ID:0
RT_RCDATA
ID:0000
ID:0
ID:2B67
ID:0
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
RT_DIALOG
ID:0065
ID:1049
RT_RCDATA
ID:0002
ID:1024
RT_GROUP_CURSOR4
ID:0065
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x1000004 size 10672 bytes
Info
PDB Path: t$di
URLs in VB Code - #1 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #6 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #7 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #8 URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #9 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #10 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #11 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #12 URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #13 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #14 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #15 URIsuspect
fthuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙