Suspicious
Suspect

64aaf2d180824d09fd565325691dcd94

PE Executable
MD5: 64aaf2d180824d09fd565325691dcd94
Size: 3.45 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 64aaf2d180824d09fd565325691dcd94
Sha1 8b2a41556cf326c7faa6373ce7f1b856b4a37534
Sha256 ff2c207c25c5644e1fc9782e9f2b8c50cc4973ef1b41db87e3e3c5245c5510df
Sha384 c8e15e4272bf9fa51ea0b5edd2bdabd25f442b794b13609acd191bdc4c2cc9740de0c9d10f3e0484e5f578bc63d0911b
Sha512 5f59c06edcd7d412a9fac8723456c7c4494cf35047f39f104c22d514b6e4be7db55c1c89e32587295a32a2cf79d245bb5d6d5327cb370d5b523452ba095e9806
SSDeep 49152:gLiewUSEtfwUSrzEVpm0SlLgOVLr/YxXG6z2nHvp/CDUxZ60HB:tjDgfVSrzEv2BVLL6XMH9Cgf
TLSH 7DF52269B1A340B2D69AF3E4034B93BDF0A53754DF955C4BB38E6F04BA73216922670C
PeID
Microsoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12
[Authenticode]_ff64964b.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.Wvz
.]Tt
._6=
.rsrc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0-preview.png
ID:0004
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:2052
RT_MANIFEST
ID:0001
ID:2052
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x346400 size 16032 bytes
[Authenticode]_ff64964b.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.Wvz
.]Tt
._6=
.rsrc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0-preview.png
ID:0004
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:2052
RT_MANIFEST
ID:0001
ID:2052
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙