General
Structural Analysis
Config.0
Yara Rules1
Sync
Community
Summary by MalvaGPT
Characteristics
|
Hash | Hash Value |
|---|---|
| MD5 | 8669bdbe64a68a76227e0fe2c99ff4cf
|
| Sha1 | 829177c36e570270ca3f29b463515f0c411d76d2
|
| Sha256 | 6d21ee2bece595eaec2814ee8c475dc278b37476645251fe5ee9d309bc58bade
|
| Sha384 | 90a2007be40f2ce869fa947d9c3397d02280e38ff64da507d780ede96caf973c8b6fc47916825c1c727883ecbb961538
|
| Sha512 | 0d343935380f14d916a2346bfa5a225c626e3e2dda275295a5d739e2e1f4bb829d97daa442debe7209386bb3cc8a5046bc3866aadbe96709e9703cf276a033c8
|
| SSDeep | 98304:Z8lZKvl1D7xga2y3lwgYpUyXRTeQi5k8Rb8UePJkusWcj:Zll1x4FpU6MQi5XJ8Ue8b
|
| TLSH | F81623D2E0984A15CC5F1BB071744D7FA867AE98F0E8B2162AC5FC4237FF7A461B411A
|
PeID
Packer=UPX Compresor..Gratuito... www.upx.sourceforge.net
Private EXE Protector V2.30-V2.3X -> SetiSoft Team
UPX -> www.upx.sourceforge.net
UPX 2.90 (LZMA)
UPX v0.80 - v0.84
UPX v2.0 -> Markus, Laszlo & Reiser
UPX v3.0
File Structure
8669bdbe64a68a76227e0fe2c99ff4cf
7z-stream @ 0x00073B6E.7z
Overlay_739ec8dd.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.itext
.data
.bss
.idata
.didata
.edata
.tls
.rdata
.reloc
.rsrc
Resources
RT_ICON
ID:0064
ID:1033
RT_STRING
ID:0FF5
ID:0
ID:0FF6
ID:0
ID:0FF7
ID:0
ID:0FF8
ID:0
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFC
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
ID:1000
ID:0
RT_RCDATA
ID:0000
ID:0
ID:2B67
ID:0
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Overlay_7dd8bff5.bin
Overlay_a280675b.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
UPX0
UPX1
.rsrc
Resources
RT_BITMAP
ID:0000
ID:0
RT_ICON
ID:0032
ID:0
ID:0033
ID:0
ID:0034
ID:0
ID:0035
ID:0
ID:0036
ID:0
ID:0037
ID:0
ID:0038
ID:0
RT_DIALOG
ID:07D4
ID:0
RT_GROUP_CURSOR4
ID:0065
ID:0
RT_VERSION
ID:0001
ID:2052
RT_MANIFEST
ID:0001
ID:2052
Informations
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Info | Overlay extracted: Overlay_a280675b.bin (3843264 bytes) |
Artefacts
|
Name0 | Value |
|---|---|
| PE Layout | MemoryMapped (process dump suspected) |
| PE Layout | MemoryMapped (process dump suspected) |
8669bdbe64a68a76227e0fe2c99ff4cf (4.32 MB)
File Structure
8669bdbe64a68a76227e0fe2c99ff4cf
7z-stream @ 0x00073B6E.7z
Overlay_739ec8dd.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.itext
.data
.bss
.idata
.didata
.edata
.tls
.rdata
.reloc
.rsrc
Resources
RT_ICON
ID:0064
ID:1033
RT_STRING
ID:0FF5
ID:0
ID:0FF6
ID:0
ID:0FF7
ID:0
ID:0FF8
ID:0
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFC
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
ID:1000
ID:0
RT_RCDATA
ID:0000
ID:0
ID:2B67
ID:0
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Overlay_7dd8bff5.bin
Overlay_a280675b.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
UPX0
UPX1
.rsrc
Resources
RT_BITMAP
ID:0000
ID:0
RT_ICON
ID:0032
ID:0
ID:0033
ID:0
ID:0034
ID:0
ID:0035
ID:0
ID:0036
ID:0
ID:0037
ID:0
ID:0038
ID:0
RT_DIALOG
ID:07D4
ID:0
RT_GROUP_CURSOR4
ID:0065
ID:0
RT_VERSION
ID:0001
ID:2052
RT_MANIFEST
ID:0001
ID:2052
Characteristics
No malware configuration were found at this point.
Artefacts
|
Name0 | Value | Location |
|---|---|---|
| PE Layout | MemoryMapped (process dump suspected) |
8669bdbe64a68a76227e0fe2c99ff4cf > 7z-stream @ 0x00073B6E.7z > LineInst.exe |
| PE Layout | MemoryMapped (process dump suspected) |
8669bdbe64a68a76227e0fe2c99ff4cf > 7z-stream @ 0x00073B6E.7z > LineInst.exe > [Rebuild from dump]_78337061.exe |
You must be signed in to post a comment.
You need a premium account to access this feature.
You must be signed in to post a comment.