Malicious
MS Office Document
MD5: be95d664bb7868d623bd36125859c1c4
Size: 22.26 MB
application/vnd.ms-office
General
Structural Analysis
Config.0
Yara Rules99+
Sync
Community
Summary by MalvaGPT
Characteristics
|
Hash | Hash Value |
|---|---|
| MD5 | be95d664bb7868d623bd36125859c1c4
|
| Sha1 | 78e5628b07e7d0c280f12d59908d78d8274046f3
|
| Sha256 | e674329819554400c080141f8826e8d0020c5efe694af1a8d0fbafd1df6d11e8
|
| Sha384 | 4d8e3495e1c4062cfbb16b7df57183d16d849efdbb115ae22e71137f409131115dc84542012632c027fed35dfede1f9a
|
| Sha512 | 2d0b73b8d6e429c8d36b1fa223d4ed95568cb569b4bb652484e05fc73ddb7e5caf5c1d1bb0659937b611726cea8975403550d9db358ab5aaf485a9a626c1c90a
|
| SSDeep | 393216:l8yd2t9zr8t8ULTgS9UzSLe0MpdO2SAsz+xb+ipRsSxKAVUr2tC9pbveer61P/GC:lxsYSHOe0w82gz2bRKAVUrsC9ka6hGQp
|
| TLSH | 5B271220759DC132FA6F01B19629EA2AE53C7DE20B7044EB93E4F95A6B314C25335F93
|
File Structure
be95d664bb7868d623bd36125859c1c4
Malicious
Root Entry
䡀䌏䈯
䡀㲞䈝䗻
䡀䈖䌧䠤
䡀䌋䄱䜵
䡀䌍䏤䊲
䡀䕎䒵䠵
䌋䄱䜵㷾䚨
䌋䄱䜵㾾䠳
䡀㬿䏲䐸䖱
䡀㽿䅤䈯䠶
䡀䈏䗤䕸䠨
䡀䈛䌪䗶䜵
䡀䋌䆨㫮䛲
䡀䒌䗱䒵䠯
䡀䓞䕪䇤䠨
䡀䕙䓲䕨䜷
䌋䄱䜵䌾䉱䠲
䡀䆊䌷䑲䈝䗻
䡀䈝䗻䗜䏼䠨
䡀䌍䈵䗦䕲䠼
䡀䒌䓰䑲䑨䠷
䌋䄱䜵䗾䅤䄥䎦
䡀㲊㬿䑲䕷䏲䛎
䡀㼿䕷䑬㭪䗤䠤
䡀㼿䕷䑬㹪䒲䠯
䡀㿿䏤䇬䗤䒬䠱
䡀䄛䌧㫲䗸䒷䠱
䡀䒌䗱䒵㮯䈹䗱
䡀䕌䄨䈷䒏䇯䕨
䡀䘌䗶䐲䆊䌷䑲
䡀䙎䑨㶷䓤䌳䊱
䌋䄱䜵䆾䐲䏳䗨䠬
䌋䄱䜵䆾䖸䌷䒦䠱
䌋䄱䜵䈾䆻䄯䌰䠦
䌋䄱䜵䌾䖱䌷䒦䠱
䌋䄱䜵䕾䐨䙲䆬䠲
䌋䄱䜵䕾䓨䌤䌵䠦
[Authenticode]_e2a82765.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.didat
.fptable
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0002
ID:1033
䌋䄱䜵䅾䑤䈱䞵䓭䠪
䌋䄱䜵䅾䑤䈱䞵䓭䠪-preview.png
䌋䄱䜵䅾䑤䈱䞵䙶䠪
䌋䄱䜵䅾䑤䈱䞵䙶䠪-preview.jpg
䌋䄱䜵䇾䄬䒯䞪䓭䠪
䌋䄱䜵䇾䄬䒯䞪䓭䠪-preview.png
䌋䄱䜵䇾䄬䒯䞪䙶䠪
䌋䄱䜵䇾䄬䒯䞪䙶䠪-preview.jpg
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.fptable
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
䡀䄕䑸䋦䒌䇱䗬䒬䠱
䡀䇊䌰㾱㼒䔨䈸䆱䠨
䡀䒌䗱䒵㬯䑲䌧䌷䑲
[Authenticode]_df1207ab.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.fptable
.rsrc
.reloc
Resources
REGISTRY
ID:27DA
ID:1033
RT_DIALOG
ID:2AB7
ID:1033
RT_STRING
ID:09C5
ID:1033
RT_VERSION
ID:0001
ID:1033
䌋䄱䜵䆾䇰䌯䎱䕤䒵䠺
[Authenticode]_36482b70.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.rsrc
.reloc
䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
䡀䒋䗲䗶䄵䓳䕨㲞䈜䘴䑨䈦
䌋䄱䜵䅾䑤䈱䞵䆶䏤㡨㠅䍾䊳
䌋䄱䜵䅾䑤䈱䞵䆶䏤㡨㠅䍾䊳-preview.png
䌋䄱䜵䅾䑤䈱䞵䆶䏤㡨㥂䍾䊳
䌋䄱䜵䅾䑤䈱䞵䆶䏤㡨㥂䍾䊳-preview.png
䌋䄱䜵䅾䑤䈱䞵䆶䏤㢨㠀䍾䊳
䌋䄱䜵䅾䑤䈱䞵䆶䏤㢨㠀䍾䊳-preview.png
䌋䄱䜵䇾䄬䒯䞪䆶䏤㡨㠅䍾䊳
䌋䄱䜵䇾䄬䒯䞪䆶䏤㡨㠅䍾䊳-preview.png
䌋䄱䜵䇾䄬䒯䞪䆶䏤㡨㥂䍾䊳
䌋䄱䜵䇾䄬䒯䞪䆶䏤㡨㥂䍾䊳-preview.png
䌋䄱䜵䇾䄬䒯䞪䆶䏤㢨㠀䍾䊳
䌋䄱䜵䇾䄬䒯䞪䆶䏤㢨㠀䍾䊳-preview.png
[Authenticode]_ae3304b6.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.fptable
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
SummaryInformation
letsvpnlatest.exe
Malicious
[NSIS Installer] @ #00015608
Malicious
modern-wizard.bmp
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_DIALOG
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.reloc
modern-header.bmp
OemVista.inf
tap0901.cat
[Authenticode]_89e08687.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
PAGE
INIT
.rsrc
.reloc
Resources
RT_RCDATA
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
[Authenticode]_454917c6.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_STRING
ID:00BC
ID:1033
ID:00BD
ID:1033
RT_RCDATA
ID:0000
ID:1033
RT_MESSAGETABLE
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
Update.exe
[Authenticode]_305d951b.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ILRepack.List
Microsoft.Web.XmlTransform.SR.resources
NuGet.CommonResources.resources
NuGet.Resources.AnalysisResources.resources
NuGet.Resources.NuGetResources.resources
NuGet.Authoring.nuspec.xsd
LetsPRO.exe
[Authenticode]_5d6a4ee5.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
[Authenticode]_b4647cdd.p7b
.Net Resources
LetsVPN.Properties.Resources.resources
LetsVPN.Properties.ResourcesOrigin.resources
LetsVPN.Resources.hosts.template
CommunityToolkit.Mvvm.dll
[Authenticode]_a760065a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
DeltaCompressionDotNet.MsDelta.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
DeltaCompressionDotNet.PatchApi.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
DeltaCompressionDotNet.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
FontAwesome.WPF.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FontAwesome.WPF.g.resources
FontAwesome.WPF.FontAwesome.Icon.png
FontAwesome.WPF.FontAwesome.Icon.png-preview.png
Hardcodet.Wpf.TaskbarNotification.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
ICSharpCode.AvalonEdit.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ICSharpCode.AvalonEdit.g.resources
ICSharpCode.AvalonEdit.Highlighting.Resources.ASPX.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.Boo.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.Coco-Mode.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.CPP-Mode.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.CSharp-Mode.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.CSS-Mode.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.HTML-Mode.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.Java-Mode.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.JavaScript-Mode.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.Json.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.MarkDown-Mode.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.MarkDownWithFontSize-Mode.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.Patch-Mode.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.PHP-Mode.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.PowerShell.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.Python-Mode.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.Tex-Mode.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.TSQL-Mode.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.VB-Mode.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.XML-Mode.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.XmlDoc.xshd
ICSharpCode.AvalonEdit.Highlighting.Resources.ModeV1.xsd
ICSharpCode.AvalonEdit.Highlighting.Resources.ModeV2.xsd
[Authenticode]_35dc2a8d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.rdata
.bss
.edata
.idata
.CRT
.tls
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
[Authenticode]_3c48aa69.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.rdata
.bss
.idata
.CRT
.tls
.rsrc
4
19
31
45
57
70
81
92
Resources
RT_VERSION
ID:0001
ID:1033
LetsPRO.exe.config
LetsPRO.ini
LetsVPNDomainModel.dll
[Authenticode]_a0cba54b.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
LetsVPNInfraStructure.dll
[Authenticode]_84227379.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0