Suspicious
Suspect

3bf52a2386ca756ee120077b997e3c18

PE Executable
MD5: 3bf52a2386ca756ee120077b997e3c18
Size: 6.15 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 3bf52a2386ca756ee120077b997e3c18
Sha1 173c90be2b60eddfb3e313fbb6913161de976b53
Sha256 79912fbd8b35fcd959de79bf1fe1a7ee3ca0cf5dfe9c5acf584ea3e995ffc633
Sha384 d490d832fc75d53576ed43ade831be44f1c3d3834d3595df04e20655bcc32759b77083b833aafcbbd2fde791aea00665
Sha512 b30f1c8c3695ce76d27b370a806851572ee6fbfe375bd9ddbdd44c5a1e0f2dfcdd62afa3ac97f6ea2e5fb3d04621f90613175d6a23eeb8542984e526c48a3afb
SSDeep 98304:VwHyF1IBgpmIzn4yK1Lu4G5bzkiPblQMWsEpuWkG7aYb66TcXxFAcnLilNFzr:yHC1I6vn4l16LRzPxQLRSG7aYG6T4iP9
TLSH 85563352BBD900B5F9EEC23008D81B92C529EF657D6095CCBB567A2D0DE0152EE09CBF
PeID
MASM/TASM - sig4 (h)Microsoft Visual C++ v6.0 DLLRAR SFXRar SFX Archive
Root Entry
䡀䆒䑲
䡀䈟䅵
䡀䌏䈯
䡀㲞䈝䗻
䡀䈖䌧䠤
䡀䌋䄱䜵
䡀䌍䏤䊲
䡀䏌䖤䠶
䡀䕎䒵䠵
䡀䕙䊲䇒
䡀㬿䏲䐸䖱
䡀㽿䅤䈯䠶
䡀䈏䗤䕸䠨
䡀䈛䌪䗶䜵
䡀䈜䉯䈛䠪
䡀䋜䕲䆷䗸
䡀䒌䗱䒵䠯
䡀䕙䓲䕨䜷
䑒䗶䏤㡀䆾䅤
䡀䆊䌷䑲䈝䗻
䡀䈝䗻䗜䏼䠨
䡀䌍䈵䗦䕲䠼
䡀䒌䓰䑲䑨䠷
䡀䛎䈷䖱䒬䠱
䡀㼿䕷䑬㭪䗤䠤
䡀㼿䕷䑬㹪䒲䠯
䡀㿿䏤䇬䗤䒬䠱
䡀䄛䌧㫲䗸䒷䠱
䡀䒌䗱䒵㮯䈹䗱
䡀䖖㪬䖶䐨䏥䠼
䡀䖖㯬䏬㱨䖤䠫
䡀䘌䗶䐲䆊䌷䑲
䡀䙎䑨㶷䓤䌳䊱
䌋䄱䜵㬾䟏䌋䐷䓤
䌋䄱䜵㾾㯳䇯㫵䑷
䆒䑲䟾㦅㠂䄆㣄䈾䈻
䆒䑲䟾䉁㢆䇅㦧䈾䈻
䌋䄱䜵㷾䚨䏏䕧䗋䠱
䡀䄕䑸䋦䒌䇱䗬䒬䠱
䡀䇊䌰㾱㼒䔨䈸䆱䠨
䡀䒌䗱䒵㬯䑲䌧䌷䑲
䡀䒖䘧䈯䈍䈳䇱䑨䜦
䡀䒖䘧䈯䌜䑪䗤䕸䠨
䡀䒖䘧䈯䒌䓰䑲䑨䖷
䡀䖖㪬䖶䐨䏥㷼䐤䠨
䌋䄱䜵㫾䑤䈱㫵䗬䄰䠳
䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
䌋䄱䜵㻾䊨䖬䈷㮵䈻䌋䠱
䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
Overlay_09335d3d.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
SummaryInformation
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.idata
.rsrc
Resources
RT_BITMAP
ID:0065
ID:1049
RT_ICON
ID:0001
ID:1024
RT_DIALOG
ID:0000
ID:1049
RT_STRING
ID:0007
ID:1049
ID:0008
ID:1049
ID:0009
ID:1049
ID:000A
ID:1049
RT_RCDATA
ID:0000
ID:0
RT_GROUP_CURSOR4
ID:0064
ID:1024
RT_MANIFEST
ID:0001
ID:1049
STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 4
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_93f4c864.bin (6045255 bytes)
Root Entry
䡀䆒䑲
䡀䈟䅵
䡀䌏䈯
䡀㲞䈝䗻
䡀䈖䌧䠤
䡀䌋䄱䜵
䡀䌍䏤䊲
䡀䏌䖤䠶
䡀䕎䒵䠵
䡀䕙䊲䇒
䡀㬿䏲䐸䖱
䡀㽿䅤䈯䠶
䡀䈏䗤䕸䠨
䡀䈛䌪䗶䜵
䡀䈜䉯䈛䠪
䡀䋜䕲䆷䗸
䡀䒌䗱䒵䠯
䡀䕙䓲䕨䜷
䑒䗶䏤㡀䆾䅤
䡀䆊䌷䑲䈝䗻
䡀䈝䗻䗜䏼䠨
䡀䌍䈵䗦䕲䠼
䡀䒌䓰䑲䑨䠷
䡀䛎䈷䖱䒬䠱
䡀㼿䕷䑬㭪䗤䠤
䡀㼿䕷䑬㹪䒲䠯
䡀㿿䏤䇬䗤䒬䠱
䡀䄛䌧㫲䗸䒷䠱
䡀䒌䗱䒵㮯䈹䗱
䡀䖖㪬䖶䐨䏥䠼
䡀䖖㯬䏬㱨䖤䠫
䡀䘌䗶䐲䆊䌷䑲
䡀䙎䑨㶷䓤䌳䊱
䌋䄱䜵㬾䟏䌋䐷䓤
䌋䄱䜵㾾㯳䇯㫵䑷
䆒䑲䟾㦅㠂䄆㣄䈾䈻
䆒䑲䟾䉁㢆䇅㦧䈾䈻
䌋䄱䜵㷾䚨䏏䕧䗋䠱
䡀䄕䑸䋦䒌䇱䗬䒬䠱
䡀䇊䌰㾱㼒䔨䈸䆱䠨
䡀䒌䗱䒵㬯䑲䌧䌷䑲
䡀䒖䘧䈯䈍䈳䇱䑨䜦
䡀䒖䘧䈯䌜䑪䗤䕸䠨
䡀䒖䘧䈯䒌䓰䑲䑨䖷
䡀䖖㪬䖶䐨䏥㷼䐤䠨
䌋䄱䜵㫾䑤䈱㫵䗬䄰䠳
䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
䌋䄱䜵㻾䊨䖬䈷㮵䈻䌋䠱
䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
Overlay_09335d3d.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
SummaryInformation
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.idata
.rsrc
Resources
RT_BITMAP
ID:0065
ID:1049
RT_ICON
ID:0001
ID:1024
RT_DIALOG
ID:0000
ID:1049
RT_STRING
ID:0007
ID:1049
ID:0008
ID:1049
ID:0009
ID:1049
ID:000A
ID:1049
RT_RCDATA
ID:0000
ID:0
RT_GROUP_CURSOR4
ID:0064
ID:1024
RT_MANIFEST
ID:0001
ID:1049
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙