Suspicious
Suspect

a48f03bf1ee28b7cf10fe4c650077740

PE Executable
|
MD5: a48f03bf1ee28b7cf10fe4c650077740
|
Size: 12.03 MB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
a48f03bf1ee28b7cf10fe4c650077740
Sha1
1f9ffef0cfa3d2bd97a98135df8ed207df73a8b0
Sha256
4aa835e4f60ef32752666a447dc715c519c4808fb4ff31b513a3f4362506849a
Sha384
85754e795c4973adfe8cd8efba220392272c83fa6c64855b5c2feb8a35fef2a6a49d185c83baae5277d74d9f2192f4c6
Sha512
aaff14bbfe7d168a4ed7e081c99b5e340da801282d1010d60b3c0efc86870e92fde781eed59ac63b45bd5a9c3514f4b6124492cfb67c950e64ebab397101de8d
SSDeep
196608:zzj26KcDLzwTmZ1wejzJU1lMDM/78B5MmvTP8uyh70a0j5EFF7bELF/594f4VzZ9:K6KEzFZ2AJU//9m7P8jBaoRYLt5mf4VL
TLSH
DFC63355E6FC01F4D877A2788A9A4D13F3BA3C450758D38F07A967462F372A4AD29B30

PeID

Microsoft Visual C++ 8.0 (DLL)
Microsoft Visual C++ v6.0 DLL
Pe123 v2006.4.4-4.12
UPolyX 0.3 -> delikon
File Structure
a48f03bf1ee28b7cf10fe4c650077740
Overlay_a2e46eed.bin
2.exe
[Authenticode]_626dfb08.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.gfids
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:1033-preview.png
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:1033-preview.png
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Budzed.crfi
Noort.sq
python36.dll
[Authenticode]_49e06abb.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.gfids
.rsrc
.reloc
Resources
RT_STRING
ID:003F
ID:1033
RT_VERSION
ID:0001
ID:1033
VCRUNTIME140.dll
[Authenticode]_3ee1e123.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.idata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Data
d3dcompiler_47.dll
[Authenticode]_183b37c0.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
devtools_resources.pak
[Base64-Block@0x00286C26]
[Base64-Block-Decoded]
[Base64-Block-Decoded]-preview.png
devtools_resources.pak
0x00282C99.svg
0x002861FD.svg
0x002887EA.svg
0x00289179.svg
0x0028A72B.svg
0x0028A84C.svg
0x0028A94C.svg
0x0028AA58.svg
0x0028AB5E.svg
0x0028D059.svg
0x0028D1A1.svg
0x0028D2B5.svg
0x0028D3A1.svg
0x0028D537.svg
0x0028D6EE.svg
0x0028D898.svg
0x0028DA4D.svg
0x0028DBAD.svg
0x0028DC9C.svg
0x0028DD7F.svg
0x0028DF1D.svg
0x0028E081.svg
0x0028E24B.svg
0x0028E39C.svg
0x0028E50C.svg
0x0028E6DD.svg
0x0028E832.svg
0x0028F2B2.svg
0x0028F501.svg
0x0028F679.svg
0x0028F7DF.svg
0x0028F947.svg
0x005C6378.svg
0x005C6378.svg-preview.jpg
0x005C6C42.svg
0x005C6C42.svg-preview.jpg
0x005C7493.svg
0x005C7493.svg-preview.jpg
0x005CF62D.svg
0x005CF62D.svg-preview.jpg
0x005CF73B.svg
0x005CF73B.svg-preview.jpg
en-US
ActiveXInstallService.adml
AddRemovePrograms.adml
AppCompat.adml
AppxPackageManager.adml
AppXRuntime.adml
AttachmentManager.adml
AuditSettings.adml
AutoPlay.adml
Biometrics.adml
Bits.adml
CEIPEnable.adml
CipherSuiteOrder.adml
COM.adml
Conf.adml
ControlPanel.adml
ControlPanelDisplay.adml
Cpls.adml
CredentialProviders.adml
CredSsp.adml
CredUI.adml
CtrlAltDel.adml
DCOM.adml
Desktop.adml
DeviceCompat.adml
DeviceInstallation.adml
DeviceSetup.adml
DFS.adml
DigitalLocker.adml
DiskDiagnostic.adml
DiskNVCache.adml
DiskQuota.adml
DistributedLinkTracking.adml
DnsClient.adml
DWM.adml
EAIME.adml
EarlyLaunchAM.adml
EdgeUI.adml
EncryptFilesonMove.adml
ErrorReporting.adml
EventForwarding.adml
EventLog.adml
EventViewer.adml
Explorer.adml
ExternalBoot.adml
FileHistory.adml
FileRecovery.adml
FileRevocation.adml
FileServerVSSProvider.adml
FileSys.adml
FolderRedirection.adml
FramePanes.adml
fthsvc.adml
GameExplorer.adml
Globalization.adml
GroupPolicy-Server.adml
GroupPolicy.adml
GroupPolicyPreferences.adml
Help.adml
HelpAndSupport.adml
hotspotauth.adml
ICM.adml
IIS.adml
InetRes.adml
InkWatson.adml
iSCSI.adml
KDC.adml
Kerberos.adml
LanmanServer.adml
LeakDiagnostic.adml
LinkLayerTopologyDiscovery.adml
LocationProviderAdm.adml
Logon.adml
MediaCenter.adml
MMC.adml
MMCSnapins.adml
MMCSnapIns2.adml
MobilePCMobilityCenter.adml
MobilePCPresentationSettings.adml
msched.adml
MSDT.adml
Msi-FileRecovery.adml
MSI.adml
NAPXPQec.adml
nca.adml
NCSI.adml
Netlogon.adml
NetworkConnections.adml
NetworkIsolation.adml
NetworkProjection.adml
OfflineFiles.adml
P2P-pnrp.adml
ParentalControls.adml
pca.adml
PeerToPeerCaching.adml
PenTraining.adml
PerformanceDiagnostics.adml
PerformancePerftrack.adml
Power.adml
PowerShellExecutionPolicy.adml
PreviousVersions.adml
Printing.adml
Printing2.adml
Programs.adml
PswdSync.adml
QOS.adml
RacWmiProv.adml
Radar.adml
ReAgent.adml
Reliability.adml
RemoteAssistance.adml
RemovableStorage.adml
RPC.adml
Scripts.adml
sdiageng.adml
Securitycenter.adml
Sensors.adml
ServerManager.adml
Servicing.adml
SettingSync.adml
Setup.adml
SharedFolders.adml
Sharing.adml
Shell-CommandPrompt-RegEditTools.adml
ShellWelcomeCenter.adml
Sidebar.adml
SkyDrive.adml
Smartcard.adml
Snis.adml
Snmp.adml
SoundRec.adml
srm-fci.adml
StartMenu.adml
SystemRestore.adml
TabletPCInputPanel.adml
TabletShell.adml
Taskbar.adml
TaskScheduler.adml
tcpip.adml
TerminalServer-Server.adml
TerminalServer.adml
Thumbnails.adml
TouchInput.adml
TPM.adml
UserProfiles.adml
VolumeEncryption.adml
W32Time.adml
WCM.adml
WDI.adml
WinCal.adml
Windows.adml
WindowsAnytimeUpgrade.adml
WindowsBackup.adml
WindowsColorSystem.adml
WindowsConnectNow.adml
WindowsDefender.adml
WindowsExplorer.adml
WindowsFileProtection.adml
WindowsFirewall.adml
WindowsMail.adml
WindowsMediaDRM.adml
WindowsMediaPlayer.adml
WindowsMessenger.adml
WindowsProducts.adml
WindowsRemoteManagement.adml
WindowsRemoteShell.adml
WindowsServer.adml
WindowsUpdate.adml
WinInit.adml
WinLogon.adml
Winsrv.adml
wlansvc.adml
WordWheel.adml
WorkFolders-Client.adml
WorkplaceJoin.adml
WPN.adml
wwansvc.adml
ffmpeg.dll
[Authenticode]_1d25e86e.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.gxfg
.retplne
.tls
_RDATA
.reloc
icudtl.dat
NAudio.xml
Updater.ex
[Authenticode]_48c0fcb3.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Updater.exe.config
v8_context_snapshot.bin
1.exe
Overlay_c393f54e.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.didat
.rsrc
.reloc
Resources
PNG
ID:0065
ID:1033
ID:1033-preview.png
ID:0066
ID:1033
ID:1033-preview.png
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:1033-preview.png
RT_DIALOG
ID:0000
ID:1033
RT_STRING
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
ID:000E
ID:1033
ID:000F
ID:1033
ID:0010
ID:1033
ID:0011
ID:1033
RT_GROUP_CURSOR4
ID:0064
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Overlay extracted: Overlay_a2e46eed.bin (11561968 bytes)
Info

PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb
Artefacts
Name
 Value
PE Layout

MemoryMapped (process dump suspected)
a48f03bf1ee28b7cf10fe4c650077740 (12.03 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙