Deep Malware Analysis of 34c53b495cd8216306cd4dff6986077c | md5: 34c53b495cd8216306cd4dff6986077c | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64 | PDB Path | Managed .NET | .Net | SOS: 0.21 | SOS: 0.20 | SOS: 0.92

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	34c53b495cd8216306cd4dff6986077c
Sha1	37e1c520d9d6359582f566e2c8339d6a2a66e546
Sha256	0beaf7839d3a1b2e0c86566fd597c159da9f154e2be236d482ecb2c9ff32e225
Sha384	35212ef188830019ad7673aede1693794fefc5648c156acff23fc4b317ab5ae35af4d70dfa12429c56aa655d810a9a45
Sha512	83c2cba903634ff5c6c5b3448eeb2cee5ed06a34fc8914325492f3cd36568dc477bdc90fc7038c0d6e95d3b65604c7c62416d0cb42b004fe6c3ac4483ebca9c5
SSDeep	393216:Kv/g4W6G87mIyAgEUa407aO200tJ47Id3Oivcy1mPZeLd:KNWh2yJEUrnI0n47qOq1eId
TLSH	37F6330AA7A034E8E516D9788946CB02E7727C8A9F70CE1F17D4FA673F62050E92D735

PeID

Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikon

34c53b495cd8216306cd4dff6986077c

Executable

PE (Portable Executable)

Overlay_baa9528b.bin

PE (Portable Executable)

OpenLink.ps1

ae_mixtwo.exe

PE (Portable Executable)

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

RT_MANIFEST

ID:0001

ID:0

.Net Resources

HomagConnect.ProductionManager.Contracts.Orders.OrderActionDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Orders.UsageDetailsPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Orders.UsageOverviewPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemFeedbackActionDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemFeedbackDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemStatusDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemTypeDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionProtocol.ProcessedItemCategoryDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionProtocol.ProductionProtocolPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkCategoryDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkReasonDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkStateDisplayNames.resources

HomagConnect.ProductionManager.Contracts.WorkstationYield.WorkstationYieldPropertyNames.resources

LfdReader.dll

Executable

PE (Portable Executable)

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.reloc

.rsrc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

IBar2Double&&

LX_Naspb0sNo0zyrCb.zip

Zip Archive

Executable

PE (Portable Executable)

re21.exe

PE (Portable Executable)

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rsrc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

ILRepack.List

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

.didat

.fptable

.rsrc

.reloc

Resources

PNG

ID:0065

ID:1033

ID:1033-preview.png

ID:0066

ID:1033

ID:1033-preview.png

RT_ICON

ID:0001

ID:1033

ID:0002

ID:1033

ID:0003

ID:1033

ID:0004

ID:1033

ID:0005

ID:1033

ID:0006

ID:1033

ID:0007

ID:1033

ID:1033-preview.png

RT_DIALOG

ID:0000

ID:1033

RT_STRING

ID:0007

ID:1033

ID:0008

ID:1033

ID:0009

ID:1033

ID:000A

ID:1033

ID:000B

ID:1033

ID:000C

ID:1033

ID:000D

ID:1033

ID:000E

ID:1033

ID:000F

ID:1033

ID:0010

ID:1033

ID:0011

ID:1033

RT_GROUP_CURSOR4

ID:0064

ID:1033

RT_MANIFEST

ID:0001

ID:1033

STICH beta

No STICH Path has been generated for this analysis yet.

9 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 8img 1

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Overlay extracted: Overlay_baa9528b.bin (15197102 bytes)
Info	PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb