Suspicious
Suspect

c056b0db5b3c2c7c7b1a3f7e71fa0e3a

Share on LinkedIn
Print
PE Executable
MD5: c056b0db5b3c2c7c7b1a3f7e71fa0e3a
Size: 3.57 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 c056b0db5b3c2c7c7b1a3f7e71fa0e3a
Sha1 83d6eba7a7f6cf5386be61a1aa67ccbb5d2a3198
Sha256 7c1ab2209ed95a0a98fb5c23e007b3bf3e8a7e7f8424a5cf5ff3331dac6ae4d7
Sha384 4f0ae89c0bbf18e83933863311b78b56702c9a04fbaa88cbf0cb1e61d09656a8995e754cbd7021ab7611926dffe86e9a
Sha512 52b4ca35f8575b866e7035a7a39d33d1becc2ada34864012482fc9d03c5502ef4ed75166c339344f8e412c699ed279ac5c6ea93656d0f06766f2036ab225bcd2
SSDeep 98304:Ojrm+RpaivYWX78aMXa3UxSODUUZn98L48lhnjk:srdaBWX7BUxSODUUZO
TLSH 33F5C031B998007BDD6B12705A0BB3ADF1FD727819F58863F294C62C2D7AC8285195EF
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ v6.0 DLL
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.fptable
.u0
.rsrc
.reloc
Resources
LYRIC_SC2TC_CHAR
ID:0FB7
ID:2052
LYRIC_SC2TC_LPTSTR
ID:0FB8
ID:2052
LYRIC_SC2TC_STRING
ID:0FB4
ID:2052
LYRIC_SC2TC_WORD
ID:0FB3
ID:2052
RT_CURSOR
ID:0001
ID:2052
ID:0002
ID:2052
ID:0003
ID:2052
ID:0004
ID:2052
ID:0005
ID:2052
ID:0006
ID:2052
ID:0007
ID:2052
ID:0008
ID:2052
ID:0009
ID:2052
ID:000A
ID:2052
ID:000B
ID:2052
ID:000C
ID:2052
ID:000D
ID:2052
ID:000E
ID:2052
ID:000F
ID:2052
ID:0010
ID:2052
RT_BITMAP
ID:7912
ID:2052
ID:7914
ID:2052
RT_DIALOG
ID:0FA1
ID:2052
ID:7801
ID:2052
ID:780E
ID:2052
RT_STRING
ID:0F01
ID:2052
ID:0F02
ID:2052
ID:0F03
ID:2052
ID:0F11
ID:2052
ID:0F12
ID:2052
ID:0F13
ID:2052
ID:0F14
ID:2052
ID:0F19
ID:2052
ID:0F1A
ID:2052
ID:0F1B
ID:2052
ID:0F1C
ID:2052
ID:0F1D
ID:2052
ID:0F2F
ID:2052
RT_GROUP_CURSOR2
ID:7901
ID:2052
ID:7916
ID:2052
ID:7917
ID:2052
ID:7918
ID:2052
ID:7919
ID:2052
ID:791A
ID:2052
ID:791B
ID:2052
ID:791C
ID:2052
ID:791D
ID:2052
ID:791E
ID:2052
ID:791F
ID:2052
ID:7920
ID:2052
ID:7921
ID:2052
ID:7922
ID:2052
ID:7923
ID:2052
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: F:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\Uninstall WeiyunApp\Release\Uninstall WeiyunApp.pdb
An error has occurred. This application may no longer respond until reloaded. Reload 🗙