Suspicious
Suspect

b13f04125bcf47f121c8618cc6384504

PE Executable
|
MD5: b13f04125bcf47f121c8618cc6384504
|
Size: 9.91 MB
|
application/x-dosexec


Print
Summary by MalvaGPT
Characteristics
Hash
Hash Value
MD5
b13f04125bcf47f121c8618cc6384504
Sha1
1418b5a7fe7eb9d43f8c3aaaf8bd800778c4a0f3
Sha256
aa412cb3954e212d73da73ceb3fb468d74b2acbbdeb09ff3eb015c914bede0a0
Sha384
88003511691c52d63dc0f30e7ae6df51c1bb81c5f00276981ce1893658185ab0af3ed9eaae092ffcd37c358a1405a9d3
Sha512
4611472ff1beea4f3f006bdfa46db57bb28d23ac92e6fdeef827eafcd14fc7359be8ee70ef683088e0db301dcfaebfe5a60756b406e0ff2b9eb379e942d73821
SSDeep
98304:xLoBG2x0j6035YeeldVFR6Av3NouhhZCENknHrZGmW600wpDDAdj1N:lo3gTefNou4akLMmpYDIjz
TLSH
F9A65921F254AA77C0EE0779409BCA701338426A4B138BC746D4D9FDFD5AAC22F75A4B

PeID

Borland Delphi 2006-2009 - Nstd EP - ASL sign
Microsoft Visual C++ 6.0 DLL (Debug)
Microsoft Visual C++ 7.0 - 8.0
Microsoft Visual C++ v6.0 DLL
Pe123 v2006.4.4-4.12
File Structure
[Authenticode]_b8379d75.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.itext
.data
.bss
.idata
.didata
.edata
.tls
.rdata
.reloc
.rsrc
.debug
Resources
RT_STRING
ID:0FF4
ID:0
ID:0FF5
ID:0
ID:0FF6
ID:0
ID:0FF7
ID:0
ID:0FF8
ID:0
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFC
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
ID:1000
ID:0
RT_RCDATA
ID:0000
[Authenticode]_e8eb5234.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.rdata
.buildid
.bss
.edata
.idata
.CRT
.tls
.rsrc
.reloc
.textbss
.msvcjmc
.00cfg
.fptable
4
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:1033-preview.png
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
ID:0
RT_MANIFEST
ID:0001
ID:1033
ID:0002
ID:1033
[Authenticode]_7786ff28.p7b
[Authenticode]_0ddc2ae5.p7b
.Net Resources
Kepkpxespsk.Properties.Resources.resources
Lopuc
[Authenticode]_1fa7b075.p7b
ID:0
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Info

Authenticode present at 0x970728 size 9800 bytes

Info

PDB Path: 

Artefacts
Name
Value
URLs in VB Code - #1

http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0

URLs in VB Code - #2

http://ocsps.ssl.com0

URLs in VB Code - #3

http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0

URLs in VB Code - #4

http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0

URLs in VB Code - #5

http://ocsps.ssl.com0P

URLs in VB Code - #6

https://www.ssl.com/repository0

URLs in VB Code - #7

http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0

URLs in VB Code - #8

http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q

URLs in VB Code - #9

http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0

URLs in VB Code - #10

http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0

URLs in VB Code - #11

http://crls.ssl.com/ssl.com-rsa-RootCA.crl0

URLs in VB Code - #12

http://gcc.gnu.org/bugs.html

URLs in VB Code - #13

http://www.videolan.org/

URLs in VB Code - #14

http://ocsp.digicert.com0A

URLs in VB Code - #15

http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C

URLs in VB Code - #16

http://crl3.digicert.com/DigiCertTrustedRootG4.crl0

URLs in VB Code - #17

http://www.digicert.com/CPS0

URLs in VB Code - #18

http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S

URLs in VB Code - #19

http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0

URLs in VB Code - #20

http://ocsp.digicert.com0

URLs in VB Code - #21

http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0

URLs in VB Code - #22

http://ocsp.digicert.com0C

URLs in VB Code - #23

http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E

URLs in VB Code - #24

http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0

URLs in VB Code - #25

http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0

URLs in VB Code - #26

http://ocsp.digicert.com0X

URLs in VB Code - #27

http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0

b13f04125bcf47f121c8618cc6384504 (9.91 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙