Suspicious
Suspect

b4a79aa404af3adc75326a9f9b3618a0

PE Executable
|
MD5: b4a79aa404af3adc75326a9f9b3618a0
|
Size: 21.72 MB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
b4a79aa404af3adc75326a9f9b3618a0
Sha1
8df652dd563865dfa66649ce2f4b2ffdb4ec953d
Sha256
6152b2d71d575a61f12a0d7cc56ac04387493c330b1fb8c934f5e1b9f755ef53
Sha384
eb5a387bd0c819025e58cab346da557e3b0b9949b2f9b117ee6a647c6dc4bac5dbc241e90c297963e81db39ce7831538
Sha512
e96b8158abc0a618925b1c470538d2fa73a050c03f3364e4c69e373db155dd8ab2e4baf1733cba6ddac9f9b8502269caadcfa0e03101e0a3437af58452dabf88
SSDeep
393216:iwFgnEMjT/PZK4CValizrtAsrTcX2uZQIBM6SDAcaQ+/uv4XDN8Rw4NmoouqO8:hYEMjDcz0izBlrTc3Z39EaQ+/uAcgq8
TLSH
AD273313628B653FF47D8E3A49B3D216183BBA2165128C67ABF8485CDE160C52E3F747

PeID

Borland Delphi 4.0
Microsoft Visual C++ v6.0 DLL
Pe123 v2006.4.4-4.12
UPolyX 0.3 -> delikon
File Structure
b4a79aa404af3adc75326a9f9b3618a0
[Authenticode]_36ddad03.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.itext
.data
.bss
.idata
.didata
.edata
.tls
.rdata
.reloc
.rsrc
Resources
RT_ICON
ID:0064
ID:1033
ID:1033-preview.png
ID:0065
ID:1033
ID:1033-preview.png
ID:0066
ID:1033
ID:1033-preview.png
ID:0067
ID:1033
ID:1033-preview.png
ID:0068
ID:1033
ID:1033-preview.png
ID:0069
ID:1033
ID:1033-preview.png
ID:006A
ID:1033
ID:1033-preview.png
RT_STRING
ID:0FF5
ID:0
ID:0FF6
ID:0
ID:0FF7
ID:0
ID:0FF8
ID:0
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFC
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
ID:1000
ID:0
RT_RCDATA
ID:0000
ID:0
ID:2F59
ID:2052
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
ApplicationFile0
[Authenticode]_7242cdb8.p7b
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Authenticode present at 0x14B3AD6 size 10264 bytes
Artefacts
Name
 Value
PE Layout

MemoryMapped (process dump suspected)
b4a79aa404af3adc75326a9f9b3618a0 (21.72 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙