General
Structural Analysis
Config.0
Yara Rules0
Sync
Community
Summary by MalvaGPT
Characteristics
|
Hash | Hash Value |
|---|---|
| MD5 | 2ec736d663b83c60aa93fa156a615488
|
| Sha1 | ace6f046ead91bf8c8996f79e901b1dbe6b106b2
|
| Sha256 | 71a2c517ebca75a515e9d3adf45a27f967e6e42c0f3da2525088c612a2712339
|
| Sha384 | e5b56b83ad01581ab9c9e9c172bdc9ddc805f790cc389f019b766a670fb307441223ff5c9ee1b57c72b41d54583fa078
|
| Sha512 | 6a85d86922c765929b17f32b64a4aba46e615d1800d19c68ea825d3792d32c31eb25e756884087225cf4f6d18a3e6bd4ced1b5f144e8395f33d37f011316cc12
|
| SSDeep | 98304:IbeekdJcleAzhxKMx+oQN4RnzM4PNQyzRXiTNT:SefAxX+oS4RzVNQpNT
|
| TLSH | 711633C108B65E71C0338AB02A40EB67A9FE3DBA05790402B5AD127DBF77974C17A797
|
PeID
Borland Delphi 4.0
Inno Setup Module [SFX] - v.5.x - 6.0 Borland Delphi - ASL
Microsoft Visual C++ v6.0 DLL
UPolyX 0.3 -> delikon
File Structure
Overlay_21624af8.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc
Resources
RT_ICON
ID:0001
ID:1043
ID:0002
ID:1043
ID:0003
ID:1043
ID:0004
ID:1043
RT_STRING
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
RT_RCDATA
ID:2B67
ID:0
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Informations
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Info | Overlay extracted: Overlay_21624af8.bin (4035083 bytes) |
2ec736d663b83c60aa93fa156a615488 (4.09 MB)
File Structure
Overlay_21624af8.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc
Resources
RT_ICON
ID:0001
ID:1043
ID:0002
ID:1043
ID:0003
ID:1043
ID:0004
ID:1043
RT_STRING
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
RT_RCDATA
ID:2B67
ID:0
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
You need a premium account to access this feature.
You must be signed in to post a comment.