Suspicious
Suspect

Installer21691x64.exe

PE Executable
MD5: 770e477b5f8cd94a6783140a3bb62225
Size: 16.92 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 770e477b5f8cd94a6783140a3bb62225
Sha1 36c20408877494fe44a04809a7730efc0d0a323a
Sha256 749009376b352dfd21f7289f549c0ed3ff515f813eb1eaf2e604ba75be02c9c2
Sha384 de97d8f371978c4804bb985ef63dd215b40a6dfd12b8138bf7d3021de6373a518f86720ccb72d1a13a948eb5bec32417
Sha512 df666499f7d927dfb5ad45472928aded35ae4b6178c77067e3bad40e95a49744e6d1e515b18eeb5cfc35a061e55b1cf879bc9d30188bcfd9f9136e893a1abffa
SSDeep 393216:cpxQTv84vaMxyerYiSX6Rse9SWC6Yuh7Ueh:gRlesiNRseIpAV9h
TLSH CD07337D31C8042CE68CEF3B173BB58882EBBD366D389125E245F1BD5534AE152F1A29
PeID
Microsoft Visual C++ v6.0 DLLRPolyCryptor V1.4.2 -> VaskaUPolyX 0.3 -> delikonx64 Themida / Winlicense v3.0.x.0 PACKED sign ASL
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.idata
.rsrc
.themida
.boot
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:1033
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.idata
.rsrc
.themida
.boot
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:1033
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙