Malicious
Malicious

1fd68db2e09a1a6a0bf877faf20a0bf4

PE Executable
|
MD5: 1fd68db2e09a1a6a0bf877faf20a0bf4
|
Size: 1.03 MB
|
application/x-dosexec

Print
General
Structural Analysis
Config.0
Yara Rules99+
Sync
Community
Infection Chain
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
1fd68db2e09a1a6a0bf877faf20a0bf4
Sha1
69e3ac1397497031a474dfbe96684268f79f075d
Sha256
629a5d51b57d61081e5e86045a36e1aec071f9fb48d306108f1a0fdfc88421e0
Sha384
f48202cd3c5999ee559b1e171185548557b6d9a53f67f1c3b4cba692a07bf3840ee3b27c740fe665429875416325eafe
Sha512
18197677dc6e558ad90c13cc0020d70366ddf105e69f8345ebf91cef358cc78fe239792a5f0a04eff09aeea4420eeaf80ced3325c4dbdf6de62627bddaeef753
SSDeep
12288:pYyDi5eJQ7uysMFZzN/E/msumBt1V34vCi9RwENz22BNhf0Uro9AFGhV3kh4v9Vi:6avgUBZ3WpRwENzlNhc0mVpKdwqrz
TLSH
28254A06B3E806E4F1F3963489724556DB72BC565B35D6CF0394462E1F73AE08E3AB22

PeID

Microsoft Visual C++ 8.0 (DLL)
Microsoft Visual C++ v6.0 DLL
File Structure
1fd68db2e09a1a6a0bf877faf20a0bf4
Malicious
Overlay_4b571aa1.bin
[Authenticode]_f791e5de.p7b
Overlay_b04071df.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.didat
_RDATA
.rsrc
Resources
LOCALIZATION_INI
ID:0087
ID:1033
RT_CURSOR
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
ID:000E
ID:1033
ID:000F
ID:1033
ID:0010
ID:1033
ID:0011
ID:1033
ID:0012
ID:1033
RT_BITMAP
ID:7912
ID:1033
ID:7914
ID:1033
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
RT_DIALOG
ID:0066
ID:1033
ID:0081
ID:1033
ID:0082
ID:1033
ID:0083
ID:1033
ID:0084
ID:1033
ID:0085
ID:1033
ID:0086
ID:1033
ID:03F0
ID:1033
ID:7801
ID:1033
ID:780E
ID:1033
RT_STRING
ID:0009
ID:1033
ID:000A
ID:1033
ID:0040
ID:1033
ID:0F01
ID:1033
ID:0F02
ID:1033
ID:0F03
ID:1033
ID:0F11
ID:1033
ID:0F12
ID:1033
ID:0F13
ID:1033
ID:0F14
ID:1033
ID:0F19
ID:1033
ID:0F1A
ID:1033
ID:0F1B
ID:1033
ID:0F1C
ID:1033
ID:0F1D
ID:1033
ID:0F2F
ID:1033
RT_GROUP_CURSOR2
ID:7901
ID:1033
ID:7916
ID:1033
ID:7917
ID:1033
ID:7918
ID:1033
ID:7919
ID:1033
ID:791A
ID:1033
ID:791B
ID:1033
ID:791C
ID:1033
ID:791D
ID:1033
ID:791E
ID:1033
ID:791F
ID:1033
ID:7920
ID:1033
ID:7921
ID:1033
ID:7922
ID:1033
ID:7923
ID:1033
RT_GROUP_CURSOR4
ID:0080
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
[Rebuild from dump]_ead11841.exe
Malicious
Informations
Name
 Value
Info

PE Detect: PeReader FAIL, AsmResolver Mapped OK
Info

Overlay extracted: Overlay_4b571aa1.bin (642712 bytes)
Info

Remap: Mapped -> FileLayout (RAM only) as [Rebuild from dump]_ead11841.exe
Artefacts
Name
 Value
PE Layout

MemoryMapped (process dump suspected)
PE Layout

MemoryMapped (process dump suspected)
1fd68db2e09a1a6a0bf877faf20a0bf4 (1.03 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙