Suspicious
Suspect

583d7d6c8da981fcf94486b9fb358be7

PE Executable
|
MD5: 583d7d6c8da981fcf94486b9fb358be7
|
Size: 10.09 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics
Hash
Hash Value
MD5
583d7d6c8da981fcf94486b9fb358be7
Sha1
987a7e784fdaebea107092917c4664eb3983030e
Sha256
68ff3ce1de760e7c481902c645f21eb683c386df14cc29b4365931eed481e26b
Sha384
c39f1f6e8287a5ddc69321e108b472b576b578104d76aa53cf50c7e8af82d2796c863ca6e971b4e0edc143836773c968
Sha512
0361dbd44c4f10970a4ca62f5be306ff2c6f5d9a2a7ca07b61f46fa049028d4b4894bbae0904cf8023c95b88649d7e49e745b1bae6f7a75fa7f37423c660229d
SSDeep
196608:+pnMSTe5ZT+X1XzWeSX/jyw8uWaZHDJ+QGA5Z9Co5+cXtX50VN96J:+pnMS6KXhzW1XD8uNqMQoIItXYW
TLSH
30A633803F41DDF8C82A4932AF5EEB468432EB9A2A405F57D2769F790FE3654470B1D8

PeID

Microsoft Visual C++
Microsoft Visual C++ 5.0
Microsoft Visual C++ 6.0 DLL (Debug)
Microsoft Visual C++ v6.0
Microsoft Visual C++ v6.0
Microsoft Visual C++ v6.0 DLL
File Structure
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:2052
RT_MANIFEST
ID:0002
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.idata
.gfids
.00cfg
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:1033-preview.png
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.idata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:2052
RT_MANIFEST
ID:0002
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:2052
RT_MANIFEST
ID:0002
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
text
data
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.data1
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:2052
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.tls
.gfids
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.gfids
.tls
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.gfids
.tls
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.gfids
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.idata
.gfids
.00cfg
.rsrc
.reloc
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
fothk
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
Resources
RT_ICON
ID:0001
ID:1049
ID:0002
ID:1049
ID:0003
ID:1049
ID:0004
ID:1049
ID:0005
ID:1049
RT_GROUP_CURSOR4
ID:0065
ID:1049
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Artefacts
Name
Value
PDB Path

d:\SVN\4???????????????\AudioRender\trunk\WindowsAudioRender\bin\win64\Private_PDB64\AudioRender.pdb

PDB Path

D:\jenkins_ci\workspace\Pack_Client_Tool_VSPlayer\code\bin\Windows\x64\FileCut.pdb

URLs in VB Code - #1

http://ocsp.globalsign.com/rootr103

URLs in VB Code - #2

http://crl.globalsign.com/root.crl0G

URLs in VB Code - #3

https://www.globalsign.com/repository/0

URLs in VB Code - #4

http://ocsp.globalsign.com/rootr30

URLs in VB Code - #5

http://secure.globalsign.com/cacert/root-r3.crt06

URLs in VB Code - #6

http://crl.globalsign.com/root-r3.crl0G

URLs in VB Code - #7

http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=

URLs in VB Code - #8

http://ocsp.globalsign.com/gsgccr45codesignca20200V

URLs in VB Code - #9

http://crl.globalsign.com/gsgccr45codesignca2020.crl0

URLs in VB Code - #10

http://ocsp2.globalsign.com/rootr606

URLs in VB Code - #11

http://crl.globalsign.com/root-r6.crl0G

URLs in VB Code - #12

http://ocsp.globalsign.com/ca/gstsacasha384g40C

URLs in VB Code - #13

http://secure.globalsign.com/cacert/gstsacasha384g4.crt0

URLs in VB Code - #14

http://crl.globalsign.com/ca/gstsacasha384g4.crl0

URLs in VB Code - #15

http://ocsp.globalsign.com/codesigningrootr450F

URLs in VB Code - #16

http://secure.globalsign.com/cacert/codesigningrootr45.crt0A

URLs in VB Code - #17

http://crl.globalsign.com/codesigningrootr45.crl0V

URLs in VB Code - #18

https://d.symcb.com/cps0%

URLs in VB Code - #19

https://d.symcb.com/rpa0

URLs in VB Code - #20

http://s.symcd.com06

URLs in VB Code - #21

http://s.symcb.com/universal-root.crl0

URLs in VB Code - #22

https://d.symcb.com/rpa0@

URLs in VB Code - #23

http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0

URLs in VB Code - #24

http://ts-ocsp.ws.symantec.com0

URLs in VB Code - #25

http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0

PDB Path

g:\project\????????????\????????????\??????????????????????????????\FileOperator\branches\FileAnalyzer\2016\VSPlayer2016??????\Bin\win64\PDB\FileAnalyzer.pdb

PDB Path

g:\project\????????????\????????????\??????????????????????????????\FileOperator\branches\FileEdit\2014\VSPlayer7.0??????\Release\FileEdit.pdb

PDB Path

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb

PDB Path

msvcr90.amd64.pdb

PDB Path

d:\academe_Jenkins\workspace\Academe-cci-Pipeline\20209\out\win64\PDB\PlayCtrl.pdb

PDB Path

C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb

PDB Path

C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb

PDB Path

C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb

URLs in VB Code - #1

file:///

PDB Path

C:\Users\qt\work\qt\qtbase\lib\Qt5Xml.pdb

PDB Path

D:\jenkins_ci\workspace\Pack_Client_Tool_VSPlayer\code\bin\Windows\x64\UIComponents.pdb

URLs in VB Code - #1

http://www.w3.org/1999/02/22-rdf-syntax-ns#

URLs in VB Code - #2

http://ns.adobe.com/xap/1.0/mm/

URLs in VB Code - #3

http://ns.adobe.com/xap/1.0/sType/ResourceRef#

URLs in VB Code - #4

http://ns.adobe.com/xap/1.0/

PDB Path

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb

PDB Path

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb

583d7d6c8da981fcf94486b9fb358be7 (10.09 MB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:2052
RT_MANIFEST
ID:0002
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.idata
.gfids
.00cfg
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:1033-preview.png
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.idata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:2052
RT_MANIFEST
ID:0002
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:2052
RT_MANIFEST
ID:0002
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
text
data
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.data1
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:2052
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.tls
.gfids
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.gfids
.tls
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.gfids
.tls
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.gfids
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.idata
.gfids
.00cfg
.rsrc
.reloc
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
fothk
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
Resources
RT_ICON
ID:0001
ID:1049
ID:0002
ID:1049
ID:0003
ID:1049
ID:0004
ID:1049
ID:0005
ID:1049
RT_GROUP_CURSOR4
ID:0065
ID:1049
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Characteristics
No malware configuration were found at this point.
Artefacts
Name
Value Location
PDB Path

d:\SVN\4???????????????\AudioRender\trunk\WindowsAudioRender\bin\win64\Private_PDB64\AudioRender.pdb

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > AudioRender.dll

PDB Path

D:\jenkins_ci\workspace\Pack_Client_Tool_VSPlayer\code\bin\Windows\x64\FileCut.pdb

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #1

http://ocsp.globalsign.com/rootr103

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #2

http://crl.globalsign.com/root.crl0G

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #3

https://www.globalsign.com/repository/0

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #4

http://ocsp.globalsign.com/rootr30

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #5

http://secure.globalsign.com/cacert/root-r3.crt06

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #6

http://crl.globalsign.com/root-r3.crl0G

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #7

http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #8

http://ocsp.globalsign.com/gsgccr45codesignca20200V

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #9

http://crl.globalsign.com/gsgccr45codesignca2020.crl0

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #10

http://ocsp2.globalsign.com/rootr606

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #11

http://crl.globalsign.com/root-r6.crl0G

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #12

http://ocsp.globalsign.com/ca/gstsacasha384g40C

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #13

http://secure.globalsign.com/cacert/gstsacasha384g4.crt0

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #14

http://crl.globalsign.com/ca/gstsacasha384g4.crl0

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #15

http://ocsp.globalsign.com/codesigningrootr450F

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #16

http://secure.globalsign.com/cacert/codesigningrootr45.crt0A

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #17

http://crl.globalsign.com/codesigningrootr45.crl0V

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #18

https://d.symcb.com/cps0%

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #19

https://d.symcb.com/rpa0

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #20

http://s.symcd.com06

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #21

http://s.symcb.com/universal-root.crl0

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #22

https://d.symcb.com/rpa0@

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #23

http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #24

http://ts-ocsp.ws.symantec.com0

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

URLs in VB Code - #25

http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Cluster_Runn.exe

PDB Path

g:\project\????????????\????????????\??????????????????????????????\FileOperator\branches\FileAnalyzer\2016\VSPlayer2016??????\Bin\win64\PDB\FileAnalyzer.pdb

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > FileAnalyzer.dll

PDB Path

g:\project\????????????\????????????\??????????????????????????????\FileOperator\branches\FileEdit\2014\VSPlayer7.0??????\Release\FileEdit.pdb

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > FileEdit.dll

PDB Path

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > MSVCP140.dll

PDB Path

msvcr90.amd64.pdb

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > MSVCR90.dll

PDB Path

d:\academe_Jenkins\workspace\Academe-cci-Pipeline\20209\out\win64\PDB\PlayCtrl.pdb

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > PlayCtrl.dll

PDB Path

C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Qt5Core.dll

PDB Path

C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Qt5Gui.dll

PDB Path

C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Qt5Widgets.dll

URLs in VB Code - #1

file:///

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Qt5Widgets.dll

PDB Path

C:\Users\qt\work\qt\qtbase\lib\Qt5Xml.pdb

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > Qt5Xml.dll

PDB Path

D:\jenkins_ci\workspace\Pack_Client_Tool_VSPlayer\code\bin\Windows\x64\UIComponents.pdb

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > UIComponents.dll

URLs in VB Code - #1

http://www.w3.org/1999/02/22-rdf-syntax-ns#

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > UIComponents.dll

URLs in VB Code - #2

http://ns.adobe.com/xap/1.0/mm/

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > UIComponents.dll

URLs in VB Code - #3

http://ns.adobe.com/xap/1.0/sType/ResourceRef#

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > UIComponents.dll

URLs in VB Code - #4

http://ns.adobe.com/xap/1.0/

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > UIComponents.dll

PDB Path

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > VCRUNTIME140.dll

PDB Path

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb

583d7d6c8da981fcf94486b9fb358be7 > 7z-stream @ 0x0002DF4B.7z > vcruntime140_1.dll

You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙