Deep Malware Analysis of 1efe2abb6d18b2635beafa60a7116a1e | md5: 1efe2abb6d18b2635beafa60a7116a1e | Executable | PE (Portable Executable) | PE Memory-Mapped (Dump) | .Net

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	1efe2abb6d18b2635beafa60a7116a1e
Sha1	1d516465c514a4b725236c432c99e48c1e5eacb8
Sha256	7d762632cff476032847ec9e7eaaa403009624e1c1ec87cb92371e84df25945d
Sha384	5b04dcd062d700e68744b00757e574816d09928a1c98cad55d86d9579096eb7915175171113b87b4a24cc120a4029e0c
Sha512	8b9caf27f25d91d070900e550833b7c50db07ec607957c3923ed95303111da00f45615e853711a8068cf70992cbf7f512feb7d722f2239e7a7f5e30f8f08216f
SSDeep	24576:Tfs4r7YFz75ELy9vS9/aOHR+SfXaYstbokJMxqavDzWLyvt487diDxHp+0J:Dsa7anKy1S9/aOHRnvaYUod1vDSLyh76
TLSH	0F95C03BB122CB6CD0CAC5B824E3D6F21D307E141AB6524656CE275F2AB3D902D5D98F

PeID

Microsoft Visual C++ v6.0 DLL

RPolyCryptor V1.4.2 -> Vaska

UPolyX 0.3 -> delikon

File Structure

Informations

Name	Value
Info	PE Detect: PeReader FAIL, AsmResolver Mapped OK
Info	Authenticode present at 0x1EFC00 size 4544 bytes
Info	Remap: Mapped -> FileLayout (RAM only) as [Rebuild from dump]_fcda5cab.exe

Artefacts

Name	Value
PE Layout	Memoryhuhuhuhuhuhuhuhuhuhuhu
PE Layout	Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys…) are available with Essential.

1efe2abb6d18b2635beafa60a7116a1e (2.04 MB)