Suspicious
Suspect

PE Executable
MD5: 68bc5656884b0407977591caaee4f9ba
Size: 1.16 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 68bc5656884b0407977591caaee4f9ba
Sha1 2edb395a35926dc8ac137208a53d1bc2e29c89e8
Sha256 7489d07f2b921da4f4a31a17ab39613e699dcc367ca40c6edff64d43ac5bc11e
Sha384 6a8decfea543259e64d2c625d2e32e48a623cec0b97b8491b22d3d713386cb39facc8052d1beeeee082b301190966a27
Sha512 3a4bcef816396414cd5940d8f0eb816da53a73d519916a00cf800dc4650c2a678b093c01251bbb48a5c2539e22e00d87f1989e2b2bfc0767642c7c0cc66f36b3
SSDeep 24576:qTuiwK+granVxOIeTpacQXDvyREr+smFX/22opSkG/UYP:qTuhngrafBeVnXEat5upSkG5
TLSH 6235BF813D9CC097E76E4DB3745E84A424A42CB9B7F120DF6B94772900B27E251BEE6C
PeID
Installer Nullsoft PiMP Stub v.3.0.x - A.S.L Microsoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft Team
[NSIS Installer] @ #00051E08
Gubbertush.Taa
Chemistries.txt
Livede.Gal
Duraspinalis.txt
Prostaglandin.txt
afsiger.car
arsens.txt
bredrvet.ini
buketrosernes.god
containerhavnen.jpg
containerhavnen.jpg-preview.png
dimensioneringens.jpg
dimensioneringens.jpg-preview.png
fakturadatoernes.ini
flowerier.jpg
flowerier.jpg-preview.png
folkeeventyrenes.txt
hmorroidernes.txt
othilies.prs
phemic.ini
sammenarbejdets.gra
toksicitetens.jpg
toksicitetens.jpg-preview.png
udbenes.jpg
udbenes.jpg-preview.png
udsvings.txt
uncompartmentalized.jpg
uncompartmentalized.jpg-preview.png
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.reloc
[SETUP_DECOMPILED.NSI]
[Authenticode]_fb421c6b.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.ndata
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
RT_DIALOG
ID:0066
ID:1033
ID:0067
ID:1033
ID:0069
ID:1033
ID:006A
ID:1033
ID:006F
ID:1033
RT_GROUP_CURSOR4
ID:0067
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x11A978 size 4992 bytes
[NSIS Installer] @ #00051E08
Gubbertush.Taa
Chemistries.txt
Livede.Gal
Duraspinalis.txt
Prostaglandin.txt
afsiger.car
arsens.txt
bredrvet.ini
buketrosernes.god
containerhavnen.jpg
containerhavnen.jpg-preview.png
dimensioneringens.jpg
dimensioneringens.jpg-preview.png
fakturadatoernes.ini
flowerier.jpg
flowerier.jpg-preview.png
folkeeventyrenes.txt
hmorroidernes.txt
othilies.prs
phemic.ini
sammenarbejdets.gra
toksicitetens.jpg
toksicitetens.jpg-preview.png
udbenes.jpg
udbenes.jpg-preview.png
udsvings.txt
uncompartmentalized.jpg
uncompartmentalized.jpg-preview.png
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.reloc
[SETUP_DECOMPILED.NSI]
[Authenticode]_fb421c6b.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.ndata
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
RT_DIALOG
ID:0066
ID:1033
ID:0067
ID:1033
ID:0069
ID:1033
ID:006A
ID:1033
ID:006F
ID:1033
RT_GROUP_CURSOR4
ID:0067
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙