Suspicious
Suspect

36d88bc9a0c2d72c3e80710252b7c30d

ZIP Archive
|
MD5: 36d88bc9a0c2d72c3e80710252b7c30d
|
Size: 13.3 MB
|
application/zip

Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
36d88bc9a0c2d72c3e80710252b7c30d
Sha1
6a2678872ea17cac5af8f3dcf880656d791b2de1
Sha256
c2ad30627f0b0fa6f849aa6df4224e9e54a15cd6cec6dca556ffdda7fd294003
Sha384
fe9941fc365cdfb72205db3f18cf818959f4b6849007047473ddd9e7fae5621dad1f9a45e103db9f5fc1c2430089f159
Sha512
1f930d4ed6798149d9d2388b1d4df146ea32d41adad24e864fa9ac811a72affdef51b2ad3ea0ec5afe60ab3d4c75f676e465f3ba980a810a0199151fb85c4853
SSDeep
393216:g4R6risk+S6gBjXpNq59Da1Rwa2PKCMCsVBp9ISb4:g44rwN6kj/q/D4OaFV9ISk
TLSH
17D63329D02AAA2653B681B544FAEC7D01537FD14D31F11C816BD19CA21EC9F2EEEB0D
File Structure
36d88bc9a0c2d72c3e80710252b7c30d
myapp
CAgent32.exe
[Authenticode]_4b1e9673.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_MANIFEST
ID:0001
ID:1033
MSVCP140.dll
[Authenticode]_2cb8e2be.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.didat
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
physics.yaml
Qt5Core.dll
[Authenticode]_06f13f62.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Qt5Gui.dll
[Authenticode]_d11d562d.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Qt5Network.dll
[Authenticode]_d1632272.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Qt5Widgets.dll
[Authenticode]_0c36be11.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
session_mon.xml
VCRUNTIME140.dll
[Authenticode]_91d55f39.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
vcruntime140_1.dll
[Authenticode]_132cfd07.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
VMProtectSDK64.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.reloc
Artefacts
Name
 Value
URLs in VB Code - #1

file:///
URLs in VB Code - #2

http://ocsp.thawte.com0
URLs in VB Code - #3

http://crl.thawte.com/ThawteTimestampingCA.crl0
URLs in VB Code - #4

http://t2.symcb.com0
URLs in VB Code - #5

http://t1.symcb.com/ThawtePCA.crl0
URLs in VB Code - #6

http://ts-ocsp.ws.symantec.com07
URLs in VB Code - #7

http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
URLs in VB Code - #8

http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
URLs in VB Code - #9

http://tl.symcb.com/tl.crl0
URLs in VB Code - #10

https://www.thawte.com/cps0/
URLs in VB Code - #11

https://www.thawte.com/repository0W
URLs in VB Code - #12

http://tl.symcb.com/tl.crt0
36d88bc9a0c2d72c3e80710252b7c30d (13.3 MB)
File Structure
36d88bc9a0c2d72c3e80710252b7c30d
myapp
CAgent32.exe
[Authenticode]_4b1e9673.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_MANIFEST
ID:0001
ID:1033
MSVCP140.dll
[Authenticode]_2cb8e2be.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.didat
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
physics.yaml
Qt5Core.dll
[Authenticode]_06f13f62.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Qt5Gui.dll
[Authenticode]_d11d562d.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Qt5Network.dll
[Authenticode]_d1632272.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Qt5Widgets.dll
[Authenticode]_0c36be11.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
session_mon.xml
VCRUNTIME140.dll
[Authenticode]_91d55f39.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
vcruntime140_1.dll
[Authenticode]_132cfd07.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
VMProtectSDK64.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.reloc
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
URLs in VB Code - #1

file:///

36d88bc9a0c2d72c3e80710252b7c30d > myapp > Qt5Widgets.dll
URLs in VB Code - #2

http://ocsp.thawte.com0

36d88bc9a0c2d72c3e80710252b7c30d > myapp > Qt5Widgets.dll
URLs in VB Code - #3

http://crl.thawte.com/ThawteTimestampingCA.crl0

36d88bc9a0c2d72c3e80710252b7c30d > myapp > Qt5Widgets.dll
URLs in VB Code - #4

http://t2.symcb.com0

36d88bc9a0c2d72c3e80710252b7c30d > myapp > Qt5Widgets.dll
URLs in VB Code - #5

http://t1.symcb.com/ThawtePCA.crl0

36d88bc9a0c2d72c3e80710252b7c30d > myapp > Qt5Widgets.dll
URLs in VB Code - #6

http://ts-ocsp.ws.symantec.com07

36d88bc9a0c2d72c3e80710252b7c30d > myapp > Qt5Widgets.dll
URLs in VB Code - #7

http://ts-aia.ws.symantec.com/tss-ca-g2.cer0

36d88bc9a0c2d72c3e80710252b7c30d > myapp > Qt5Widgets.dll
URLs in VB Code - #8

http://ts-crl.ws.symantec.com/tss-ca-g2.crl0

36d88bc9a0c2d72c3e80710252b7c30d > myapp > Qt5Widgets.dll
URLs in VB Code - #9

http://tl.symcb.com/tl.crl0

36d88bc9a0c2d72c3e80710252b7c30d > myapp > Qt5Widgets.dll
URLs in VB Code - #10

https://www.thawte.com/cps0/

36d88bc9a0c2d72c3e80710252b7c30d > myapp > Qt5Widgets.dll
URLs in VB Code - #11

https://www.thawte.com/repository0W

36d88bc9a0c2d72c3e80710252b7c30d > myapp > Qt5Widgets.dll
URLs in VB Code - #12

http://tl.symcb.com/tl.crt0

36d88bc9a0c2d72c3e80710252b7c30d > myapp > Qt5Widgets.dll
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙