Suspicious
Suspect

af698bedf30cc8f41854d3ac8ce0d9c7

Rar Archive
|
MD5: af698bedf30cc8f41854d3ac8ce0d9c7
|
Size: 8.05 MB
|
application/vnd.rar

Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
af698bedf30cc8f41854d3ac8ce0d9c7
Sha1
29e785072cd18edfdbc8adaa034890aaf53b1496
Sha256
8daf8d869ed9ee5c573e9eb2e94cf7f6ba4dd7db635ac5047b2e67d1920fcf8b
Sha384
cba874f71521d587a334a7b6efe7a5ea2103757c0a0b499946321c03424f2add6b69ac71a3ea40ea93d9d3559945915d
Sha512
38a01bffba29ecdc797ecf2cb4e6fb7d4df887c0f142c4c84d94d938228ec2100dc4bcb7c0e28d1af2cba748161f121b2a72ef86903d64b4792e3ba40acb9dde
SSDeep
196608:d7LadD4o5k040es7jzI7IXkCafxkY0AKHjhEFb03:d6NJk0wkHI7OkLiJOFw
TLSH
1E863393DBB5B6DCE671F4BB64339FE8A255F48FC04970609885BFC0B90D758A09132A
File Structure
af698bedf30cc8f41854d3ac8ce0d9c7
Executor.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.idata
.CRT
.tls
.reloc
msvcp140.dll
[Authenticode]_80c5211b.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Qt5Concurrent.dll
[Authenticode]_8556af73.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0002
ID:1033
Qt5Core.dll
[Authenticode]_def965e6.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.qtmimed
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Qt5Gui.dll
[Authenticode]_d6defc2a.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Qt5Widgets.dll
[Authenticode]_1ddef9e3.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
qwindows.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.qtmetad
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
qwindowsvistastyle.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.qtmetad
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
vcruntime140.dll
[Authenticode]_697aaa06.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
fothk
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
vcruntime140_1.dll
[Authenticode]_7d5eb6c0.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Artefacts
Name
 Value
URLs in VB Code - #1

https://marsalek.cy/paste?userid=169&is_exe=1
URLs in VB Code - #2

http://https://
URLs in VB Code - #3

https://docs.rs/rustls/latest/rustls/manual/_03_howto/index.html#unexpected-eofh
URLs in VB Code - #4

file:///
URLs in VB Code - #1

file:///
URLs in VB Code - #2

http://ocsp.digicert.com0C
URLs in VB Code - #3

http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
URLs in VB Code - #4

http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
URLs in VB Code - #5

http://ocsp.digicert.com0A
URLs in VB Code - #6

http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
URLs in VB Code - #7

http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
URLs in VB Code - #8

http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
URLs in VB Code - #9

http://ocsp.digicert.com0X
URLs in VB Code - #10

http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
URLs in VB Code - #11

http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
URLs in VB Code - #12

http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
URLs in VB Code - #13

http://www.digicert.com/CPS0
URLs in VB Code - #14

http://ocsp.digicert.com0
URLs in VB Code - #15

http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
af698bedf30cc8f41854d3ac8ce0d9c7 (8.05 MB)
File Structure
af698bedf30cc8f41854d3ac8ce0d9c7
Executor.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.idata
.CRT
.tls
.reloc
msvcp140.dll
[Authenticode]_80c5211b.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Qt5Concurrent.dll
[Authenticode]_8556af73.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0002
ID:1033
Qt5Core.dll
[Authenticode]_def965e6.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.qtmimed
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Qt5Gui.dll
[Authenticode]_d6defc2a.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Qt5Widgets.dll
[Authenticode]_1ddef9e3.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
qwindows.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.qtmetad
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
qwindowsvistastyle.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.qtmetad
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
vcruntime140.dll
[Authenticode]_697aaa06.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
fothk
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
vcruntime140_1.dll
[Authenticode]_7d5eb6c0.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
URLs in VB Code - #1

https://marsalek.cy/paste?userid=169&is_exe=1

af698bedf30cc8f41854d3ac8ce0d9c7 > Executor.exe
URLs in VB Code - #2

http://https://

af698bedf30cc8f41854d3ac8ce0d9c7 > Executor.exe
URLs in VB Code - #3

https://docs.rs/rustls/latest/rustls/manual/_03_howto/index.html#unexpected-eofh

af698bedf30cc8f41854d3ac8ce0d9c7 > Executor.exe
URLs in VB Code - #4

file:///

af698bedf30cc8f41854d3ac8ce0d9c7 > Executor.exe
URLs in VB Code - #1

file:///

af698bedf30cc8f41854d3ac8ce0d9c7 > Qt5Widgets.dll
URLs in VB Code - #2

http://ocsp.digicert.com0C

af698bedf30cc8f41854d3ac8ce0d9c7 > Qt5Widgets.dll
URLs in VB Code - #3

http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E

af698bedf30cc8f41854d3ac8ce0d9c7 > Qt5Widgets.dll
URLs in VB Code - #4

http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0

af698bedf30cc8f41854d3ac8ce0d9c7 > Qt5Widgets.dll
URLs in VB Code - #5

http://ocsp.digicert.com0A

af698bedf30cc8f41854d3ac8ce0d9c7 > Qt5Widgets.dll
URLs in VB Code - #6

http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C

af698bedf30cc8f41854d3ac8ce0d9c7 > Qt5Widgets.dll
URLs in VB Code - #7

http://crl3.digicert.com/DigiCertTrustedRootG4.crl0

af698bedf30cc8f41854d3ac8ce0d9c7 > Qt5Widgets.dll
URLs in VB Code - #8

http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0

af698bedf30cc8f41854d3ac8ce0d9c7 > Qt5Widgets.dll
URLs in VB Code - #9

http://ocsp.digicert.com0X

af698bedf30cc8f41854d3ac8ce0d9c7 > Qt5Widgets.dll
URLs in VB Code - #10

http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0

af698bedf30cc8f41854d3ac8ce0d9c7 > Qt5Widgets.dll
URLs in VB Code - #11

http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S

af698bedf30cc8f41854d3ac8ce0d9c7 > Qt5Widgets.dll
URLs in VB Code - #12

http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0

af698bedf30cc8f41854d3ac8ce0d9c7 > Qt5Widgets.dll
URLs in VB Code - #13

http://www.digicert.com/CPS0

af698bedf30cc8f41854d3ac8ce0d9c7 > Qt5Widgets.dll
URLs in VB Code - #14

http://ocsp.digicert.com0

af698bedf30cc8f41854d3ac8ce0d9c7 > Qt5Widgets.dll
URLs in VB Code - #15

http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0

af698bedf30cc8f41854d3ac8ce0d9c7 > Qt5Widgets.dll
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙