Malicious
Malicious

3e4f06be4e94542f85bde79ff9560b41

AutoIt Compiled Script
|
MD5: 3e4f06be4e94542f85bde79ff9560b41
|
Size: 1.7 MB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
3e4f06be4e94542f85bde79ff9560b41
Sha1
b51695912b78f3da16d2cc595872dce0ec5a3013
Sha256
e0210e510cdeec97354308971ac2b3f047b4df8d464896c1a2a982a35a99c070
Sha384
b4220140f46682e92bb562116773ee5e712dad2626f36e848649fe86e1db9ec1e96272ab44a018c8a83f4f81f18c0fc1
Sha512
26327c8611de68e860dec249fe22235bab1835ce74446bc4daa7bb7834628ec6501e16c22982c797ca2e06bb0039366c2039887c5f9776c0d8d98162f6ffca92
SSDeep
49152:ijuzVhRcKOZWtx/qGjoKJGbB2bs7J7ytz3E:r2KqWtxjWH78z3E
TLSH
7775220D6BE45183F1361B74ACF5C365A339B9706B394A9F0548A179CE133DA6E22BCC

PeID

Microsoft Visual C++ 8.0 (DLL)
UPolyX 0.3 -> delikon
File Structure
3e4f06be4e94542f85bde79ff9560b41
Malicious
[Authenticode]_0f7ba765.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
AVI
ID:0BB9
ID:1033
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
RT_DIALOG
ID:07D1
ID:1033
ID:07D2
ID:1033
ID:07D3
ID:1033
ID:07D4
ID:1033
ID:07D5
ID:1033
ID:07D6
ID:1033
RT_STRING
ID:003F
ID:1033
ID:004C
ID:1033
ID:004D
ID:1033
ID:0050
ID:1033
ID:0053
ID:1033
ID:0055
ID:1033
RT_RCDATA
ID:0000
ID:1033
RT_GROUP_CURSOR4
ID:0BB8
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Deleted
Malicious
autFA58.tmp.tok
Malicious
[Cleaned].au3
Malicious
Rentcom.exe
[Authenticode]_2f8fc85c.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.fptable
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:2057
ID:0002
ID:2057
ID:0003
ID:2057
ID:0004
ID:2057
ID:0005
ID:2057
ID:0006
ID:2057
ID:0007
ID:2057
ID:2057-preview.png
ID:0008
ID:2057
ID:0009
ID:2057
ID:000A
ID:2057
ID:000B
ID:2057
ID:000C
ID:2057
ID:000D
ID:2057
RT_MENU
ID:00A6
ID:2057
RT_DIALOG
ID:03E8
ID:2057
RT_STRING
ID:0007
ID:2057
ID:0008
ID:2057
ID:0009
ID:2057
ID:000A
ID:2057
ID:000B
ID:2057
ID:000C
ID:2057
ID:0139
ID:2057
RT_GROUP_CURSOR4
ID:0063
ID:2057
ID:00A2
ID:2057
ID:00A4
ID:2057
ID:00A9
ID:2057
RT_VERSION
ID:0001
ID:2057
RT_MANIFEST
ID:0001
ID:1033
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Authenticode present at 0x19D000 size 9768 bytes
Info

PDB Path: wextract.pdb
3e4f06be4e94542f85bde79ff9560b41 (1.7 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙