Suspicious
Suspect

b0df398b5457a15972b2625d16a21319

PE Executable
MD5: b0df398b5457a15972b2625d16a21319
Size: 3.13 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 b0df398b5457a15972b2625d16a21319
Sha1 ad73664da1df1e031d4771085a366bdf8dde8caa
Sha256 5ff753b070e7f44223920d9f2b33db3c99875b2b9d442469275521ce9ff7a5cb
Sha384 971a8300e3cf5ab82bb9b853566d6bd8cc58ef95f03822a812be01189d584e4e2f2773c4d36eb791e5c01a3eb2f5906c
Sha512 e4c8d2bb80c15ec9a0091b6336e451cd1bec98e491a9638b3a0e6571ed992cb393a3ce0a17b23ddb219f42045deffe2019094b2d0eda1ebd85424e6be1017a8c
SSDeep 49152:U2t9j0oqDVcwzAa6EINWbqccbB5Vmaa2HCxYcjMY:U27N0v
TLSH 52E58D03FCA12AE6C46E62314D769192BB72BC442F3123DB2A90B7782F72BD05DB5754
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.xdata
.idata
.reloc
.symtab
.rsrc
Resources
RT_ICON
ID:0001
ID:2052
ID:2052-preview.png
ID:0002
ID:2052
ID:0003
ID:2052
ID:0004
ID:2052
ID:0005
ID:2052
ID:0006
ID:2052
ID:0007
ID:2052
ID:0008
ID:2052
RT_GROUP_CURSOR4
ID:0000
ID:2052
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.xdata
.idata
.reloc
.symtab
.rsrc
Resources
RT_ICON
ID:0001
ID:2052
ID:2052-preview.png
ID:0002
ID:2052
ID:0003
ID:2052
ID:0004
ID:2052
ID:0005
ID:2052
ID:0006
ID:2052
ID:0007
ID:2052
ID:0008
ID:2052
RT_GROUP_CURSOR4
ID:0000
ID:2052
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙