Suspicious
Suspect

57feffb846ff30911e654e3e9974bbae

PE Executable
MD5: 57feffb846ff30911e654e3e9974bbae
Size: 10.83 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 57feffb846ff30911e654e3e9974bbae
Sha1 0cb9ac2ae002d4ad086610847bfb1cb2ac32230b
Sha256 5a8b1642337e8e19fd54e8f9f03e899cfd66735ea3f2188a6182d49cbefab7b9
Sha384 4134422839f977550161cab871ed701281f7b31727f2ae68212c9b20ecb177c646b943266cf457971699ad93d4c6935e
Sha512 d26681645dff25abddd608da217e3a810e98004e7e5b54ac8730a27432ccc29eb632eaf8339953482c64ed17d34033d573504afc599661df47050a08ef04a53a
SSDeep 49152:/HqD5VMo3iVhVfY5ugRTagd87FwkOi9ohm:/i9g3RFww9
TLSH B6B68D07FCD548E9C45A6330C9A686857B32BC851B3623D32EA0B7BC2EB2BD45C39755
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikontElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!
[Authenticode]_f2ecce86.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.xdata
.idata
.reloc
.symtab
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:1033-preview.png
ID:0002
ID:1033
ID:1033-preview.png
ID:0003
ID:1033
ID:1033-preview.png
ID:0004
ID:1033
ID:1033-preview.png
ID:0005
ID:1033
ID:1033-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:1033
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0xA52C00 size 2432 bytes
[Authenticode]_f2ecce86.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.xdata
.idata
.reloc
.symtab
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:1033-preview.png
ID:0002
ID:1033
ID:1033-preview.png
ID:0003
ID:1033
ID:1033-preview.png
ID:0004
ID:1033
ID:1033-preview.png
ID:0005
ID:1033
ID:1033-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:1033
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙