Suspect
PE Executable
MD5:
Size: 0 B
application/x-dosexec
The file c187bee6e02e4d1210657d545f614cb5 is a PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 294 embedded or derived files. It matches 45 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- —
- MD5
- -
- Verdict
- Inconclusive
- File type
- PE Executable
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Detection
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12VC8 -> Microsoft Corporation
287 files
EXEc187bee6e02e4d1210657d545f614cb5
Structure
P7B[Authenticode]_a1f310a6.p7b
BINResources
DLLScreenConnect.Client.dll
DLLScreenConnect.ClientService.dll
DLLScreenConnect.Core.dll
DLLScreenConnect.Windows.dll
DLLScreenConnect.WindowsAuthenticationPackage.dll
EXEScreenConnect.WindowsBackstageShell.exe
BINScreenConnect.WindowsBackstageShell.exe.config
EXEScreenConnect.WindowsClient.exe
DLLScreenConnect.WindowsCredentialProvider.dll
EXEScreenConnect.WindowsFileManager.exe
BINServiceExeWithoutService
DLLScreenConnect.InstallerActions.dll
DLLMicrosoft.Deployment.WindowsInstaller.dll
DLLMicrosoft.Deployment.WindowsInstaller.Package.dll
DLLMicrosoft.Deployment.Compression.dll
DLLMicrosoft.Deployment.Compression.Cab.dll
BINCustomAction.config
| Name | Value |
|---|---|
| Info | Authenticode present at 0x53D800 size 167448 bytes |
| Info | PDB Path: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb |
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential