Try now !

Malicious

be95d664bb7868d623bd36125859c1c4

Open options

Share on LinkedIn Add to favorites Add to collection

Download sample Download JSON report Print

Re-Scan

MS Office Document

MD5: be95d664bb7868d623bd36125859c1c4

Size: 22.26 MB

application/vnd.ms-office

Office Document

SVG

CAB:COMPRESSION:MSZIP

Executable

PE (Portable Executable)

PE File Layout

PDB Path

Managed .NET

.Net

SOS: 0.23

SOS: 0.21

SOS: 0.11

SOS: 0.24

SOS: 0.19

SOS: 0.25

SOS: 0.28

SOS: 0.27

SOS: 0.52

SOS: 0.22

SOS: 0.32

SOS: 0.26

SOS: 0.30

SOS: 0.15

SOS: 0.00

SOS: 0.06

SOS: 0.20

SOS: 0.17

SOS: 0.16

SOS: 0.35

SOS: 0.18

SOS: 0.47

SOS: 0.39

SOS: 0.40

SOS: 0.29

SOS: 0.31

SOS: 0.43

SOS: 0.01

SOS: 0.04

SOS: 0.41

SOS: 0.73

SOS: 0.14

SOS: 0.68

SOS: 0.13

PowerShell

DeObfuscated

General

Structural Analysis

Config.0

Yara Rules99+

Sync

Community

Summary by MalvaGPT

Generate AI Summary

Characteristics

Hash	Hash Value
MD5	be95d664bb7868d623bd36125859c1c4
Sha1	78e5628b07e7d0c280f12d59908d78d8274046f3
Sha256	e674329819554400c080141f8826e8d0020c5efe694af1a8d0fbafd1df6d11e8
Sha384	4d8e3495e1c4062cfbb16b7df57183d16d849efdbb115ae22e71137f409131115dc84542012632c027fed35dfede1f9a
Sha512	2d0b73b8d6e429c8d36b1fa223d4ed95568cb569b4bb652484e05fc73ddb7e5caf5c1d1bb0659937b611726cea8975403550d9db358ab5aaf485a9a626c1c90a
SSDeep	393216:l8yd2t9zr8t8ULTgS9UzSLe0MpdO2SAsz+xb+ipRsSxKAVUr2tC9pbveer61P/GC:lxsYSHOe0w82gz2bRKAVUrsC9ka6hGQp
TLSH	5B271220759DC132FA6F01B19629EA2AE53C7DE20B7044EB93E4F95A6B314C25335F93

File Structure

be95d664bb7868d623bd36125859c1c4

Office Document

SVG

CAB:COMPRESSION:MSZIP

Executable

PE (Portable Executable)

PE File Layout

PDB Path

Managed .NET

.Net

SOS: 0.23

SOS: 0.21

SOS: 0.11

SOS: 0.24

SOS: 0.19

SOS: 0.25

SOS: 0.28

SOS: 0.27

SOS: 0.52

SOS: 0.22

SOS: 0.32

SOS: 0.26

SOS: 0.30

SOS: 0.15

SOS: 0.00

SOS: 0.06

SOS: 0.20

SOS: 0.17

SOS: 0.16

SOS: 0.35

SOS: 0.18

SOS: 0.47

SOS: 0.39

SOS: 0.40

SOS: 0.29

SOS: 0.31

SOS: 0.43

SOS: 0.01

SOS: 0.04

SOS: 0.41

SOS: 0.73

SOS: 0.14

SOS: 0.68

SOS: 0.13

PowerShell

DeObfuscated

Malicious

Root Entry

䡀䌏䈯

䡀㲞䈝䗻

䡀䈖䌧䠤

䡀䌋䄱䜵

䡀䌍䏤䊲

䡀䕎䒵䠵

䌋䄱䜵㷾䚨

䌋䄱䜵㾾䠳

䌧䎶䞁䄦䠥

CAB:COMPRESSION:MSZIP

䡀㬿䏲䐸䖱

䡀㽿䅤䈯䠶

䡀䈏䗤䕸䠨

䡀䈛䌪䗶䜵

䡀䋌䆨㫮䛲

䡀䒌䗱䒵䠯

䡀䓞䕪䇤䠨

䡀䕙䓲䕨䜷

䌋䄱䜵䌾䉱䠲

䡀䆊䌷䑲䈝䗻

䡀䈝䗻䗜䏼䠨

䡀䌍䈵䗦䕲䠼

䡀䒌䓰䑲䑨䠷

䌋䄱䜵䗾䅤䄥䎦

䡀㲊㬿䑲䕷䏲䛎

䡀㼿䕷䑬㭪䗤䠤

䡀㼿䕷䑬㹪䒲䠯

䡀㿿䏤䇬䗤䒬䠱

䡀䄛䌧㫲䗸䒷䠱

䡀䒌䗱䒵㮯䈹䗱

䡀䕌䄨䈷䒏䇯䕨

䡀䘌䗶䐲䆊䌷䑲

䡀䙎䑨㶷䓤䌳䊱

䌋䄱䜵䆾䐲䏳䗨䠬

䌋䄱䜵䆾䖸䌷䒦䠱

䌋䄱䜵䈾䆻䄯䌰䠦

䌋䄱䜵䌾䖱䌷䒦䠱

䌋䄱䜵䕾䐨䙲䆬䠲

䌋䄱䜵䕾䓨䌤䌵䠦

䌋䄱䜵㹾䈵䈵䞴䏧䠯

Executable

PE (Portable Executable)

PE File Layout

Win 32 Exe

x86

PDB Path

[Authenticode]_e2a82765.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.didat

.fptable

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:1033

RT_MANIFEST

ID:0002

ID:1033

䌋䄱䜵䅾䑤䈱䞵䓭䠪

䌋䄱䜵䅾䑤䈱䞵䓭䠪-preview.png

䌋䄱䜵䅾䑤䈱䞵䙶䠪

䌋䄱䜵䅾䑤䈱䞵䙶䠪-preview.jpg

䌋䄱䜵䇾䄬䒯䞪䓭䠪

䌋䄱䜵䇾䄬䒯䞪䓭䠪-preview.png

䌋䄱䜵䇾䄬䒯䞪䙶䠪

䌋䄱䜵䇾䄬䒯䞪䙶䠪-preview.jpg

䌋䄱䜵䙾䈬䈺䞵䛨䠨

Executable

PE (Portable Executable)

PE File Layout

Win 32 Exe

x86

PDB Path

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.fptable

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:1033

RT_MANIFEST

ID:0001

ID:1033

䡀䄕䑸䋦䒌䇱䗬䒬䠱

䡀䇊䌰㾱㼒䔨䈸䆱䠨

䡀䒌䗱䒵㬯䑲䌧䌷䑲

䌋䄱䜵䄾䆬䖸䄷䗦䇾䏯

Executable

PE (Portable Executable)

PE File Layout

Win 32 Exe

x86

PDB Path

[Authenticode]_df1207ab.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.fptable

.rsrc

.reloc

Resources

REGISTRY

ID:27DA

ID:1033

RT_DIALOG

ID:2AB7

ID:1033

RT_STRING

ID:09C5

ID:1033

RT_VERSION

ID:0001

ID:1033

䌋䄱䜵䆾䇰䌯䎱䕤䒵䠺

䌋䄱䜵䙾䈬䈺䞵䛨䟨䠁

Executable

PE (Portable Executable)

PE File Layout

Win 64 Exe

x64

PDB Path

[Authenticode]_36482b70.p7b

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

.fptable

.rsrc

.reloc

䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶

䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨

䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦

䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨

䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦

䡀䒋䗲䗶䄵䓳䕨㲞䈜䘴䑨䈦

䌋䄱䜵䅾䑤䈱䞵䆶䏤㡨㠅䍾䊳

䌋䄱䜵䅾䑤䈱䞵䆶䏤㡨㠅䍾䊳-preview.png

䌋䄱䜵䅾䑤䈱䞵䆶䏤㡨㥂䍾䊳

䌋䄱䜵䅾䑤䈱䞵䆶䏤㡨㥂䍾䊳-preview.png

䌋䄱䜵䅾䑤䈱䞵䆶䏤㢨㠀䍾䊳

䌋䄱䜵䅾䑤䈱䞵䆶䏤㢨㠀䍾䊳-preview.png

䌋䄱䜵䇾䄬䒯䞪䆶䏤㡨㠅䍾䊳

䌋䄱䜵䇾䄬䒯䞪䆶䏤㡨㠅䍾䊳-preview.png

䌋䄱䜵䇾䄬䒯䞪䆶䏤㡨㥂䍾䊳

䌋䄱䜵䇾䄬䒯䞪䆶䏤㡨㥂䍾䊳-preview.png

䌋䄱䜵䇾䄬䒯䞪䆶䏤㢨㠀䍾䊳

䌋䄱䜵䇾䄬䒯䞪䆶䏤㢨㠀䍾䊳-preview.png

䌋䄱䜵㼾䉲䚷䕤㭨䗨䆨䒷䞵䏧䠯

Executable

PE (Portable Executable)

PE File Layout

Win 32 Exe

x86

PDB Path

[Authenticode]_ae3304b6.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.fptable

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:1033

SummaryInformation

be95d664bb7868d623bd36125859c1c4

0x00020FCC.svg

SVG

0x0004F0DF.svg

SVG

letsvpnlatest.exe

Archive Entry

NSIS Installer

Executable

PE (Portable Executable)

PE File Layout

Win 32 Exe

x86

PDB Path

Managed .NET

.Net

SOS: 0.23

SOS: 0.21

SOS: 0.11

SOS: 0.24

SOS: 0.19

SOS: 0.25

SOS: 0.28

SOS: 0.27

SOS: 0.52

SOS: 0.22

SOS: 0.32

SOS: 0.26

SOS: 0.30

SOS: 0.15

SOS: 0.00

SOS: 0.06

SOS: 0.20

SOS: 0.17

SOS: 0.16

SOS: 0.35

SOS: 0.18

SOS: 0.47

SOS: 0.39

SOS: 0.40

SOS: 0.29

SOS: 0.31

SOS: 0.43

SOS: 0.01

SOS: 0.04

SOS: 0.41

SOS: 0.73

SOS: 0.14

SOS: 0.68

SOS: 0.13

PowerShell

DeObfuscated

Malicious

[NSIS Installer] @ #00015608

Malicious

modern-wizard.bmp

Installer Entry

nsDialogs.dll

Installer Entry

Executable

PE (Portable Executable)

PE File Layout

Win 32 Exe

x86

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.rsrc

.reloc

Resources

RT_DIALOG

ID:0001

ID:1033

System.dll

Installer Entry

Executable

PE (Portable Executable)

PE File Layout

Win 32 Exe

x86

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.reloc

modern-header.bmp

Installer Entry

OemVista.inf

Installer Entry

tap0901.cat

Installer Entry

tap0901.sys

Installer Entry

Executable

PE (Portable Executable)

PE File Layout

Win 64 Exe

x64

PDB Path

[Authenticode]_89e08687.p7b

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

PAGE

INIT

.rsrc

.reloc

Resources

RT_RCDATA

ID:0000

ID:1033

RT_VERSION

ID:0001

ID:1033

tapinstall.exe

Installer Entry

Executable

PE (Portable Executable)

PE File Layout

Win 64 Exe

x64

PDB Path

[Authenticode]_454917c6.p7b

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

.rsrc

.reloc

Resources

RT_STRING

ID:00BC

ID:1033

ID:00BD

ID:1033

RT_RCDATA

ID:0000

ID:1033

RT_MESSAGETABLE

ID:0001

ID:1033

RT_VERSION

ID:0001

ID:1033

Update.exe

Installer Entry

SFX 7z

Executable

PE (Portable Executable)

Managed .NET

PE File Layout

Win 32 Exe

x86

.Net

SOS: 0.23

7z-stream @ 0x000B0D00.7z

Archive Entry

SFX 7z

7z Archive

[Authenticode]_305d951b.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

RT_MANIFEST

ID:0001

ID:0

.Net Resources

ILRepack.List

Microsoft.Web.XmlTransform.SR.resources

NuGet.CommonResources.resources

NuGet.Resources.AnalysisResources.resources

NuGet.Resources.NuGetResources.resources

NuGet.Authoring.nuspec.xsd

LetsPRO.exe

Installer Entry

Html

Javascript in Html

Executable

PE (Portable Executable)

Managed .NET

PE File Layout

Win 32 Exe

x86

PDB Path

.Net

SOS: 0.28

[Authenticode]_5d6a4ee5.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.rsrc

.reloc

Resources

RT_ICON

ID:0001

ID:0

ID:0-preview.png

RT_GROUP_CURSOR4

ID:7F00

ID:0

RT_VERSION

ID:0001

ID:0

[Authenticode]_b4647cdd.p7b

.Net Resources

LetsPRO.g.resources

Html

Javascript in Html

LetsVPN.Properties.Resources.resources

LetsVPN.Properties.ResourcesOrigin.resources

LetsVPN.Resources.hosts.template

CommunityToolkit.Mvvm.dll

Installer Entry

Executable

PE (Portable Executable)

Managed .NET

PE File Layout

Win 32 Exe

x86

PDB Path

.Net

SOS: 0.21

[Authenticode]_a760065a.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

DeltaCompressionDotNet.MsDelta.dll

Installer Entry

Executable

PE (Portable Executable)

Managed .NET

PE File Layout

Win 32 Exe

x86

PDB Path

.Net

SOS: 0.11

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

DeltaCompressionDotNet.PatchApi.dll

Installer Entry

Executable

PE (Portable Executable)

Managed .NET

PE File Layout

Win 32 Exe

x86

PDB Path

.Net

SOS: 0.24

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

DeltaCompressionDotNet.dll

Installer Entry

Executable

PE (Portable Executable)

Managed .NET

PE File Layout

Win 32 Exe

x86

PDB Path

.Net

SOS: 0.23

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

FontAwesome.WPF.dll

Installer Entry

Executable

PE (Portable Executable)

Managed .NET

PE File Layout

Win 32 Exe

x86

PDB Path

.Net

SOS: 0.19

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

FontAwesome.WPF.g.resources

FontAwesome.WPF.FontAwesome.Icon.png

FontAwesome.WPF.FontAwesome.Icon.png-preview.png

Hardcodet.Wpf.TaskbarNotification.dll

Installer Entry

Executable

PE (Portable Executable)

Managed .NET

PE File Layout

Win 32 Exe

x86

PDB Path

.Net

SOS: 0.25

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

ICSharpCode.AvalonEdit.dll

Installer Entry

Executable

PE (Portable Executable)

Managed .NET

PE File Layout

Win 32 Exe

x86

PDB Path

.Net

SOS: 0.23

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

ICSharpCode.AvalonEdit.g.resources

ICSharpCode.AvalonEdit.Highlighting.Resources.ASPX.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.Boo.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.Coco-Mode.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.CPP-Mode.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.CSharp-Mode.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.CSS-Mode.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.HTML-Mode.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.Java-Mode.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.JavaScript-Mode.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.Json.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.MarkDown-Mode.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.MarkDownWithFontSize-Mode.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.Patch-Mode.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.PHP-Mode.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.PowerShell.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.Python-Mode.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.Tex-Mode.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.TSQL-Mode.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.VB-Mode.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.XML-Mode.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.XmlDoc.xshd

ICSharpCode.AvalonEdit.Highlighting.Resources.ModeV1.xsd

ICSharpCode.AvalonEdit.Highlighting.Resources.ModeV2.xsd

LetsGoogleAnalytics.dll

Installer Entry

Executable

PE (Portable Executable)

PE File Layout

Win 32 Exe

x86

[Authenticode]_35dc2a8d.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.data

.rdata

.bss

.edata

.idata

.CRT

.tls

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:1033

LetsGoogleAnalytics.exe

Installer Entry

Executable

PE (Portable Executable)

PE File Layout

Win 32 Exe

x86

[Authenticode]_3c48aa69.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.data

.rdata

.bss

.idata

.CRT

.tls

.rsrc

4

19

31

45

57

70

81

92

Resources

RT_VERSION

ID:0001

ID:1033

LetsPRO.exe.config

Installer Entry

LetsPRO.ini

Installer Entry

LetsVPNDomainModel.dll

Installer Entry

Executable

PE (Portable Executable)

Managed .NET

PE File Layout

Win 32 Exe

x86

PDB Path

.Net

SOS: 0.27

[Authenticode]_a0cba54b.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

LetsVPNInfraStructure.dll

Installer Entry

Executable

PE (Portable Executable)

Managed .NET

PE File Layout

Win 32 Exe

x86

PDB Path

.Net

SOS: 0.52

[Authenticode]_84227379.p7b

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

MdXaml.dll

Installer Entry

Executable

PE (Portable Executable)

Managed .NET

PE File Layout

Win 32 Exe

x86