Suspicious
Suspect

bcbbe129e6032fdbee6e2df28fef55e3

PE Executable
|
MD5: bcbbe129e6032fdbee6e2df28fef55e3
|
Size: 4.71 MB
|
application/x-dosexec


Print
Summary by MalvaGPT
Characteristics
Hash
Hash Value
MD5
bcbbe129e6032fdbee6e2df28fef55e3
Sha1
fb9e26f45ee4cbe3c80895cc43f20575dfbcc5a7
Sha256
03231f35406136a3aa0c41b2e89375451177fe8cb025ed1341443b4bd4c21c7f
Sha384
f8bf2759a88fbb30734cb5f2b5aa35719c36e82262581419d6ef07413774e2f0c9e0fb625941be8a670bc6c5eb7a27e6
Sha512
33c851763e17e7bd070a5a0ac8ddf06b621291a8d008b0e23d3f773e3cfa7accd1b3a61437b77e07e3b45053864c8df8baea981f00ca1c18ff8222a4f814e220
SSDeep
98304:bLnsPAtMWV7PwyLSSJQvWUCLtb8LpyIK/tJY4SKLfBzo:bjsYjN9UCxqk17Y4SK
TLSH
E926E0097F80AC25D869F330A17556618A25EF23C66188873B6CBF399B341F37D3961B

PeID

Microsoft Visual C++ 6.0 DLL (Debug)
Microsoft Visual C++ 7.0 - 8.0
Microsoft Visual C++ 8
Microsoft Visual C++ 8
Microsoft Visual C++ v6.0 DLL
VC8 -> Microsoft Corporation
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
AFX_DIALOG_LAYOUT
ID:0000
ID:2052
BIN
ID:0082
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
INIT
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:2052
ID:0083
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_BITMAP
ID:0070
ID:2052
ID:0071
ID:2052
ID:0072
ID:2052
ID:007A
ID:2052
RT_DIALOG
ID:0065
ID:2052
ID:006B
ID:2052
ID:006E
ID:2052
ID:0073
ID:2052
RT_GROUP_CURSOR4
ID:006D
ID:2052
ID:0076
ID:2052
ID:0077
ID:2052
ID:0078
ID:2052
RT_VERSION
ID:0001
ID:2052
RT_MANIFEST
ID:0002
ID:1033
ID:0086
[Authenticode]_3c3469b7.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_CURSOR
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
ID:0009
ID:0
ID:000A
ID:0
RT_GROUP_CURSOR2
ID:0000
ID:0
RT_VERSION
ID:0001
ID:4105
PNG
ID:0000
ID:2052
ID:2052-preview.png
RT_BITMAP
ID:008D
ID:2052
ID:008E
ID:2052
RT_ICON
ID:0001
ID:2052
ID:2052-preview.png
ID:0002
ID:2052
ID:0003
ID:2052
ID:0004
ID:2052
ID:0005
ID:2052
ID:0006
ID:2052
ID:0007
ID:2052
ID:2052-preview.png
ID:0008
ID:2052
ID:0009
ID:2052
ID:000A
ID:2052
ID:000B
ID:2052
ID:000C
ID:2052
ID:0013
ID:2052
ID:0014
ID:2052
ID:0015
ID:2052
ID:0016
ID:2052
ID:0017
ID:2052
ID:0018
ID:2052
ID:0019
ID:2052
ID:001A
ID:2052
ID:001B
ID:2052
ID:001C
ID:2052
ID:001D
ID:2052
ID:001E
ID:2052
ID:001F
ID:2052
ID:0020
ID:2052
ID:0021
ID:2052
ID:0022
ID:2052
RT_MENU
ID:0071
ID:2052
RT_DIALOG
ID:0068
ID:2052
ID:0069
ID:2052
ID:007F
ID:2052
ID:0081
ID:2052
ID:0094
ID:2052
ID:0095
ID:2052
RT_GROUP_CURSOR4
ID:0065
ID:2052
ID:0083
ID:2052
ID:0087
ID:2052
ID:008B
ID:2052
ID:008C
ID:2052
ID:0093
ID:2052
RT_VERSION
ID:0001
ID:2052
RT_HTML
ID:0067
ID:2052
ID:0077
ID:2052
ID:0079
ID:2052
ID:0096
ID:2052
ID:0098
ID:2052
RT_MANIFEST
ID:0001
ID:1033
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Info

PDB Path: D:\Programming\WinProjects\JiYuTrainer\Release\JiYuTrainer.pdb

Artefacts
Name
Value
URLs in VB Code - #1

http://imengyu.top/services/update/JiYuTrainer/

URLs in VB Code - #2

http://curl.haxx.se/docs/http-cookies.html

URLs in VB Code - #3

https://github.com/ht0Ruial

URLs in VB Code - #4

https://github.com/ht0Ruial/Jiyu_udp_attack

URLs in VB Code - #5

http://www.w3.org/1999/02/22-rdf-syntax-ns#

URLs in VB Code - #6

http://ns.adobe.com/xap/1.0/

URLs in VB Code - #7

http://ns.adobe.com/xap/1.0/mm/

URLs in VB Code - #8

http://ns.adobe.com/xap/1.0/sType/ResourceEvent#

URLs in VB Code - #9

http://purl.org/dc/elements/1.1/

URLs in VB Code - #10

http://ns.adobe.com/photoshop/1.0/

URLs in VB Code - #11

http://ns.adobe.com/xap/1.0/sType/ResourceRef#

URLs in VB Code - #12

http://ns.adobe.com/tiff/1.0/

URLs in VB Code - #13

http://ns.adobe.com/exif/1.0/

URLs in VB Code - #1

http://www.winimage.com/zLibDll

URLs in VB Code - #2

file://path

URLs in VB Code - #3

http://t2.symcb.com0

URLs in VB Code - #4

http://t1.symcb.com/ThawtePCA.crl0

URLs in VB Code - #5

http://tl.symcb.com/tl.crl0

URLs in VB Code - #6

https://www.thawte.com/cps0/

URLs in VB Code - #7

https://www.thawte.com/repository0W

URLs in VB Code - #8

http://tl.symcb.com/tl.crt0

URLs in VB Code - #9

https://sciter.com0/

bcbbe129e6032fdbee6e2df28fef55e3 (4.71 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙