Suspect
874c713546c21ca87434f1440843338e
PE Executable
MD5: 874c713546c21ca87434f1440843338e
Size: 6.47 MB
application/x-dosexec
This sample is a 6.2 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 32 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 493611327d5d4fe06460977a0295586a9a67434ffc90282a69028fa1f12e3ce9
- MD5
- 874c713546c21ca87434f1440843338e
- Verdict
- Inconclusive
- File type
- PE Executable · 6.2 MB
Cite this report: https://app.malva.re/sha256/493611327d5d4fe06460977a0295586a9a67434ffc90282a69028fa1f12e3ce9
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
6.47 MB · 6,468,420 B
Hashes
MD5
874c713546c21ca87434f1440843338e
Sha1
3be04f3ded6c292d6dbb1344dc9b53d82a6a31f1
Sha256
493611327d5d4fe06460977a0295586a9a67434ffc90282a69028fa1f12e3ce9
Sha384
8ef18adda952aab8383716f3317e0fa18e9d5bc398038826297fd0a42f68f83a7a1130290115fa97a51da5fdc0d92049
Sha512
f9048cc057feede1bd044b5e0b5d5531e88df8f64ecdddb0a315b5cd9a9741633240fa3af6e11f176e4bfdd9320dc11a2248def2c2cfbdc1ca3e82b6281b4b80
SSDeep
196608:p+/eDsP+5nwoADtJmUrVkcKd9o0xQ4TWeVM1/b:p+/eDheoADJrVkcM9qKMhb
TLSH
2B563322BBE406BBF2B21270A93353A05BFFBC344B75455B97A055888F728F5C4A8357
Detection
PeID
Borland Delphi 4.0Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikon
32 files
EXE874c713546c21ca87434f1440843338e
Structure
BINOverlay_f278a751.bin
DLLIKernel.dll
Structure
BINResources
BINPUBLICKEY
BINID:00D0
BINID:1033
BINRT_STRING
BINID:0007
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
DLLctor.dll
Structure
BINOverlay_e83c0736.bin
BINResources
BINRT_STRING
BINID:0007
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
DLLIScript.dll
Structure
BINResources
BINRT_STRING
BINID:0007
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
DLLIUser.dll
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINRT_DIALOG
BINID:00CD
BINID:1033
BINRT_STRING
BINID:0007
BINID:1033
BINRT_GROUP_CURSOR4
BINID:00C9
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
DLLobjectps.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXEDotNetInstaller.exe
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
RGSiKernel.rgs
TLBISProBE9x.tlb
TLBISProBENT.tlb
BINResources
BINRT_ICON
BINID:0001
BINID:1049
BINRT_RCDATA
BINID:0000
BINID:0
BINRT_GROUP_CURSOR4
BINID:0000
BINID:1049
STICH
beta
No STICH Path has been generated for this analysis yet.
5 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.
bin
5| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_f278a751.bin (6426948 bytes) |
32 files
EXE874c713546c21ca87434f1440843338e
Structure
BINOverlay_f278a751.bin
DLLIKernel.dll
DLLctor.dll
DLLIScript.dll
DLLIUser.dll
DLLobjectps.dll
EXEDotNetInstaller.exe
RGSiKernel.rgs
TLBISProBE9x.tlb
TLBISProBENT.tlb
BINResources
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules.
Create a free account