Suspect
PE Executable
MD5: 5ddabfd1ba4063dfbac30101c47229f8
Size: 12.28 MB
application/x-dosexec
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 5ddabfd1ba4063dfbac30101c47229f8 |
| Sha1 | bdcd8c58d06d588362161d325b4e9eee4d44f30c |
| Sha256 | 34b78a64d76e3d03455fa25dda4292eea59dea145f0c3f2c2addcb7380ff988b |
| Sha384 | 15a7620d3c552aefae46369a5cec63fc518996dd16f54ab9c5af5a2f61b8a63ac83aac0a88d013a3492f553e64ee44f9 |
| Sha512 | 72348fabd2ea89824f9ecf6aa2a8e46331b342ded07fcc8d27396d6db1b586617240a143e2fdb67987f0d55a2d69c0d11868b3f1eba3cefeaaf2d89b1186b06c |
| SSDeep | 196608:tQdpV9sN6fpp1Wqj0gY8HYXQ6ZsIAZaNAextA7e8HLPYRwuZnQQ3ifXURu6qFaDC:usNS1f0D8CTsIAanxuK8c8XUU63YF |
| TLSH | A0C633A99FD011FAD22EF27485D3372AC77B74291BE39E8F43566CA10F735944829B02 |
PeID
Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 10
STICH kept: 1secondary ignored: 9
bin
6img
3Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>arc:rar>pe:exe
Shape
pe:exe>arc:rar>pe:exe
3 nodes
| Name | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Info | Overlay extracted: Overlay_a21d6b55.bin (11651428 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb |