Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 2f618c9fb28870f29543c04c0d98a16e
Size: 5.8 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 2f618c9fb28870f29543c04c0d98a16e
Sha1 d23a42294c9d07f94f537ca5255d97570e696ecb
Sha256 4ef56fe1c4c570f02e7248013ab4b44dcdfdeff54ec9792a3bfca7abedbff4b5
Sha384 b79c1a410561936d859d7860f5876a1fda621faf2d8ca84140fcec927b51135c4ee6f48cd9d49d2867c088f291a6fe9a
Sha512 89ff478d1ff7b264c75787b7bd7c6c4304db865857d367ddde34f78a18cc6605c33bc965defabcfd80c47b4d34d870956bcb31f23ac588a6f416531712560b10
SSDeep 98304:rtN/0sO6G+RQ6zAMkREv6L3tZ9jHr8zOXXxEHuW+Xthc/qH1M0feHYcsP7OunAqg:rta6G+qMkREihZ9jHr8zOXh8dqHae9DY
TLSH 1E4633453BC14572D9A521332462D77227BDADA14F05ABD3B3A87A35E930CC0E739B2B
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
2f618c9fb28870f29543c04c0d98a16e
Overlay_845830db.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.didat
.rsrc
.reloc
Resources
PNG
ID:0065
ID:2052
ID:2052-preview.png
ID:0066
ID:2052
ID:2052-preview.png
RT_ICON
ID:0001
ID:2052
ID:0002
ID:2052
ID:0003
ID:2052
ID:0004
ID:2052
ID:0005
ID:2052
ID:0006
ID:2052
ID:0007
ID:2052
ID:2052-preview.png
RT_DIALOG
ID:0000
ID:2052
RT_STRING
ID:0007
ID:2052
ID:0008
ID:2052
ID:0009
ID:2052
ID:000A
ID:2052
ID:000B
ID:2052
ID:000C
ID:2052
ID:000D
ID:2052
ID:000E
ID:2052
ID:000F
ID:2052
ID:0010
ID:2052
ID:0011
ID:2052
RT_GROUP_CURSOR4
ID:0064
ID:2052
RT_MANIFEST
ID:0001
ID:2052
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_845830db.bin (5470563 bytes)
Info
PDB Path: D:\Projects\WinRAR\SFX\build\sfxzip32\Release\sfxzip.pdb
An error has occurred. This application may no longer respond until reloaded. Reload 🗙