Suspicious
Suspect

512514a79990a4628c0a450ed9f5a958

PE Executable
|
MD5: 512514a79990a4628c0a450ed9f5a958
|
Size: 21.99 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
512514a79990a4628c0a450ed9f5a958
Sha1
e0a732008769d621e76d77fb4d5291ccfea87b40
Sha256
16ed87bc2ca3fb12aa50ed5de9ffeb8ba14df383e937d9dd047464e7a2c2c859
Sha384
9de14b3e866a3b20357de08c50dd8e55448284b016b12b4b4197d2ac3a7f657cff11d44fc54d887f38b473d7e134aaa7
Sha512
d08f4d83ff1f84ba68a9450427c1b85c7f0e82dcf28e2b44875fba37b59d0e6c2efee72a7ff43c370d9d24120b37dbd50ff9af54dc7d3a4690e6148de66c395c
SSDeep
393216:KiHw18fXV+dBaJsv6tWKFdu9C1mrqfwkvsq+nmt9MmX5ahr12+naI0UGDrGGSDkE:KwfgnUOmjB7w
TLSH
EC276B97B3A65291C577D23CCA8B461BE2B3780187228BCB55598B591F337E21B3FB01

PeID

HQR data file
MASM/TASM - sig4 (h)
Microsoft Visual C++ 8.0 (DLL)
Microsoft Visual C++ v6.0 DLL
Pe123 v2006.4.4-4.12
Private EXE Protector V2.30-V2.3X -> SetiSoft Team
RPolyCryptor V1.4.2 -> Vaska
File Structure
512514a79990a4628c0a450ed9f5a958
[Rebuild from dump]_6df18416.exe
Informations
Name
 Value
Info

PE Detect: PeReader FAIL, AsmResolver Mapped OK
Info

Remap: Mapped -> FileLayout (RAM only) as [Rebuild from dump]_6df18416.exe
Artefacts
Name
 Value
PE Layout

MemoryMapped (process dump suspected)
URLs in VB Code - #1

https://space.bilibili.com/3493110082439389
URLs in VB Code - #2

https://www.gnu.org/licenses/gpl-3.0.html#license-text
URLs in VB Code - #3

https://longlonger2022.github.io
URLs in VB Code - #4

http://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Third%20Party%20Component%20CA%202013.crl0
URLs in VB Code - #5

http://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Third%20Party%20Component%20CA%202013.crt0
URLs in VB Code - #6

http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0
URLs in VB Code - #7

http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0
URLs in VB Code - #8

http://www.microsoft.com0
URLs in VB Code - #9

http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l
URLs in VB Code - #10

http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0
URLs in VB Code - #11

http://www.microsoft.com/pkiops/Docs/Repository.htm0
URLs in VB Code - #12

http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
URLs in VB Code - #13

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
URLs in VB Code - #14

http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
URLs in VB Code - #15

http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
URLs in VB Code - #16

http://www.microsoft.com/pkiops/docs/primarycps.htm0@
URLs in VB Code - #17

http://ocsp.entrust.net00
URLs in VB Code - #18

http://crl.entrust.net/g2ca.crl0
URLs in VB Code - #19

http://www.entrust.net/rpa0
URLs in VB Code - #20

http://ocsp.entrust.net05
URLs in VB Code - #21

http://aia.entrust.net/evcs1-chain256.cer01
URLs in VB Code - #22

http://crl.entrust.net/evcs1.crl0
URLs in VB Code - #23

https://www.entrust.net/rpa0
URLs in VB Code - #24

http://www.entrust.net/rpa03
URLs in VB Code - #25

http://ocsp.entrust.net02
URLs in VB Code - #26

http://crl.entrust.net/2048ca.crl0
URLs in VB Code - #27

http://ocsp.entrust.net03
URLs in VB Code - #28

http://aia.entrust.net/ts1-chain256.cer01
URLs in VB Code - #29

http://crl.entrust.net/ts1ca.crl0
URLs in VB Code - #30

http://www.w3.org/2000/xmlns/
URLs in VB Code - #31

http://www.w3.org/XML/1998/namespace
URLs in VB Code - #32

http://www.w3.org/TR/REC-html40/strict.dtd
URLs in VB Code - #33

http://www.w3.org/1999/xlink
URLs in VB Code - #34

http://www.color.org
URLs in VB Code - #35

http://www.w3.org/1999/02/22-rdf-syntax-ns#
URLs in VB Code - #36

http://purl.org/dc/elements/1.1/
URLs in VB Code - #37

http://ns.adobe.com/xap/1.0/
URLs in VB Code - #38

http://ns.adobe.com/pdf/1.3/
URLs in VB Code - #39

http://www.aiim.org/pdfa/ns/id/
URLs in VB Code - #40

file:///
PE Layout

MemoryMapped (process dump suspected)
512514a79990a4628c0a450ed9f5a958 (21.99 MB)
File Structure
512514a79990a4628c0a450ed9f5a958
[Rebuild from dump]_6df18416.exe
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
PE Layout

MemoryMapped (process dump suspected)

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #1

https://space.bilibili.com/3493110082439389

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #2

https://www.gnu.org/licenses/gpl-3.0.html#license-text

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #3

https://longlonger2022.github.io

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #4

http://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Third%20Party%20Component%20CA%202013.crl0

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #5

http://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Third%20Party%20Component%20CA%202013.crt0

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #6

http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #7

http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #8

http://www.microsoft.com0

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #9

http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #10

http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #11

http://www.microsoft.com/pkiops/Docs/Repository.htm0

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #12

http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #13

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #14

http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #15

http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #16

http://www.microsoft.com/pkiops/docs/primarycps.htm0@

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #17

http://ocsp.entrust.net00

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #18

http://crl.entrust.net/g2ca.crl0

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #19

http://www.entrust.net/rpa0

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #20

http://ocsp.entrust.net05

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #21

http://aia.entrust.net/evcs1-chain256.cer01

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #22

http://crl.entrust.net/evcs1.crl0

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #23

https://www.entrust.net/rpa0

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #24

http://www.entrust.net/rpa03

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #25

http://ocsp.entrust.net02

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #26

http://crl.entrust.net/2048ca.crl0

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #27

http://ocsp.entrust.net03

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #28

http://aia.entrust.net/ts1-chain256.cer01

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #29

http://crl.entrust.net/ts1ca.crl0

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #30

http://www.w3.org/2000/xmlns/

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #31

http://www.w3.org/XML/1998/namespace

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #32

http://www.w3.org/TR/REC-html40/strict.dtd

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #33

http://www.w3.org/1999/xlink

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #34

http://www.color.org

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #35

http://www.w3.org/1999/02/22-rdf-syntax-ns#

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #36

http://purl.org/dc/elements/1.1/

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #37

http://ns.adobe.com/xap/1.0/

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #38

http://ns.adobe.com/pdf/1.3/

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #39

http://www.aiim.org/pdfa/ns/id/

512514a79990a4628c0a450ed9f5a958
URLs in VB Code - #40

file:///

512514a79990a4628c0a450ed9f5a958
PE Layout

MemoryMapped (process dump suspected)

512514a79990a4628c0a450ed9f5a958 > [Rebuild from dump]_6df18416.exe
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙