Deep Malware Analysis of 54f923e1cbb15513b8e5092d94e703e2 | md5: 54f923e1cbb15513b8e5092d94e703e2 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64 | PDB Path | Managed .NET | .Net | SOS: 0.21 | SOS: 0.20 | SOS: 0.92

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	54f923e1cbb15513b8e5092d94e703e2
Sha1	6f266d50974b9712dcc59fd3ca8eb43973de1dca
Sha256	05b37b0056fcd2365b5caf484a08939fb2ef6310b36b187f2bf1002ef8bf6901
Sha384	bcb50275ab0e847fcbd7c409cc9c6d538e4049410efa767d543016fcbb5191b05683f2b72617f3eaf5d4441f3e845acc
Sha512	34cfffe5d925e4b295b367d7859184b4343115d722b56304e22b2f6b6438644cb1bd491ddc81eca1e24762fb9ffdf4f9b38fa4f373e0e8dfe49364d3e16c07b8
SSDeep	98304:J2VpxxUZKdU3Ka/MVqCKcuafR3R95Q6xekwxohPh3ejUOYJSg76a8Z7eJgk1K9r2:axxbU6kMYCKjA0kMoTOjKJKDo6z9rqd
TLSH	7D361205BB5420AAF8729374CFAFC691EA61F806331091DB27BC655B1EBB1F1CE1A711

PeID

Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikon

54f923e1cbb15513b8e5092d94e703e2

Executable

PE (Portable Executable)

Overlay_73ec0857.bin

PE (Portable Executable)

OpenLink.ps1

ae_mixtwo.exe

PE (Portable Executable)

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

RT_MANIFEST

ID:0001

ID:0

.Net Resources

HomagConnect.ProductionManager.Contracts.Orders.OrderActionDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Orders.UsageDetailsPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Orders.UsageOverviewPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemFeedbackActionDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemFeedbackDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemStatusDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemTypeDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionProtocol.ProcessedItemCategoryDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionProtocol.ProductionProtocolPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkCategoryDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkReasonDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkStateDisplayNames.resources

HomagConnect.ProductionManager.Contracts.WorkstationYield.WorkstationYieldPropertyNames.resources

LfdReader.dll

Executable

PE (Portable Executable)

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.reloc

.rsrc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

IBar2Double&&

LX_Naspb0sNo0zyrCb.zip

Zip Archive

Executable

PE (Portable Executable)

re21.exe

PE (Portable Executable)

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rsrc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

ILRepack.List

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

.didat

.fptable

.rsrc

.reloc

Resources

PNG

ID:0065

ID:1033

ID:1033-preview.png

ID:0066

ID:1033

ID:1033-preview.png

RT_ICON

ID:0001

ID:1024

RT_DIALOG

ID:0000

ID:1033

RT_STRING

ID:0007

ID:1033

ID:0008

ID:1033

ID:0009

ID:1033

ID:000A

ID:1033

ID:000B

ID:1033

ID:000C

ID:1033

ID:000D

ID:1033

ID:000E

ID:1033

ID:000F

ID:1033

ID:0010

ID:1033

ID:0011

ID:1033

RT_GROUP_CURSOR4

ID:0064

ID:1024

RT_MANIFEST

ID:0001

ID:1033

STICH beta

No STICH Path has been generated for this analysis yet.

9 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 8img 1

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Overlay extracted: Overlay_73ec0857.bin (4466518 bytes)
Info	PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb