Suspicious
Suspect

c6d5cd8ea8b15e744a248c0487add93f

Share on LinkedIn
Print
PE Executable
MD5: c6d5cd8ea8b15e744a248c0487add93f
Size: 1.8 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 c6d5cd8ea8b15e744a248c0487add93f
Sha1 858c1beac55a1ddaf0bfe7f8a492e27c78eea639
Sha256 d3cc55551c40941bcaf8e738ee5e5c16d1589b58eb5ec0a74dce693a347e6a69
Sha384 49faae4623e1cd29521902344e64b8a7a977af51ad0d2193ecbbda3baab4992f518ba39c9cefb2c5996c518dd1499aa3
Sha512 bceb148dcdb762592181d417539cdeb8bb63dba60bcc87f31bab5c0ebc82254dc0a99543f30dfd34549cf720cdf43d041257069b75ede96beb11d9c3526cfce8
SSDeep 24576:/fR7tTXSE7pes9y9YyAdyfBuCwpeN4ygAmbj5d:bXShV9dxExAqr
TLSH A085D0D30EC48E4AD96B6DFC0360E43AE5216CB99913681E8CE9B66D73367C63F50325
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
c6d5cd8ea8b15e744a248c0487add93f
[Authenticode]_3ed70343.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
ID:0009
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
PDFMaestroSetup.g.resources
PDFMaestroSetup.Properties.Resources.resources
PDFMaestroSetup.appSettings.json
adbff106b3f84260d840f753664aad99
0f9aec2573824d6d5ebbe2aff408d9e9
55774d727d834356826501a260fcf9eb
aeda3adf310845cff9a6a5b8d5279675
a053061f3e4249614dfc1a8978404784
bda7b3e639a0401273a3a087ff001d6d
04638312edc74ea1dd4b4fb666639f84
20da0ab1e7db40398232655e47d3639c
340fc96c124a48dafa21e59f7e5a6329
cafe8f9baa8b4392b58b47a205bb088f
3e7dd91b1d1d4ae61bb6266d8c4bba79
c878cbb3d5a04f7608e940bebe457cdd
ec28658a510342466e27b5822b1161ab
a287d57f0bd04e71b3a76ea63176a321
9f2a50a6dfe44b513ac98e9fdceb19c5
         
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x1B3E00 size 10352 bytes
Module Name
PDFMaestroSetup.exe
Full Name
PDFMaestroSetup.exe
EntryPoint
System.Int32  ::(System.String[])
Scope Name
PDFMaestroSetup.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
PDFMaestroSetup
Assembly Version
1.1.0.13
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
0
Main Method
System.Int32  ::(System.String[])
Main IL Instruction Count
3
Main IL 
ldarg.0 <null>
call System.Int32 -.iilI11lll1Ii::<Main>(System.String[])
ret <null>
Module Name
PDFMaestroSetup.exe
Full Name
PDFMaestroSetup.exe
EntryPoint
System.Int32  ::(System.String[])
Scope Name
PDFMaestroSetup.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
PDFMaestroSetup
Assembly Version
1.1.0.13
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
0
Main Method
System.Int32  ::(System.String[])
Main IL Instruction Count
3
Main IL 
ldarg.0 <null>
call System.Int32 -.iilI11lll1Ii::<Main>(System.String[])
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙