Suspicious
Suspect

d1aad5e46b5659869ec0c7d2bc049a9d

PE Executable
|
MD5: d1aad5e46b5659869ec0c7d2bc049a9d
|
Size: 2.29 MB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
d1aad5e46b5659869ec0c7d2bc049a9d
Sha1
1a2566de43937bd59c75e84861a3426082892a7b
Sha256
ef35e3d843043518bacc8245bf32cc2dda251b5a61b6fe48a9c0a94eab46142b
Sha384
ab2d363630860aac80ad08994c8a04609d35f90d877b21dcc17ec45ed04b4cabb514da4b075b4ff16221ca1f65a5e8f0
Sha512
edcfe0271568020ed500e4a78f695ffd9dafb4129927c63e2ef2f2327dbce6608d34492605e2556d0d6286c06be846439f36a0fe50a20636fe6a82336b0da82f
SSDeep
49152:813Z/5f/udkulTST6APcCcXN90ywBQ2aZs:2x3cE2AkCcXD0ywLaG
TLSH
F8B57A92B212830AFD0F19F5E6D2B363E332AB41A61391066634255CCB5FDA43FD619F

PeID

Microsoft Visual C++ DLL
Microsoft Visual C++ v6.0
File Structure
d1aad5e46b5659869ec0c7d2bc049a9d
[Authenticode]_bb9bf215.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
PDFSkills.g.resources
PDFSkills.Properties.Resources.resources
PDFSkills.Belongings.Update_files.zip
Update_files
concrt140.dll
[Authenticode]_5a91aa43.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Libraries.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0002
ID:0
msvcp140.dll
[Authenticode]_e0a04d88.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
msvcp140_1.dll
[Authenticode]_f6e7a8a0.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
msvcp140_2.dll
[Authenticode]_c9eb478f.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
msvcp140_atomic_wait.dll
[Authenticode]_6eeb8791.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
msvcp140_codecvt_ids.dll
[Authenticode]_da44cdfd.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
PDFSkills_Updater.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Update.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.nep
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0002
ID:1033
vcamp140.dll
[Authenticode]_86b87ddc.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
WEVT_TEMPLATE
ID:0001
ID:1033
RT_MESSAGETABLE
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
vccorlib140.dll
[Authenticode]_6a130018.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
vcomp140.dll
[Authenticode]_095b3f58.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_STRING
ID:003F
ID:1033
ID:007E
ID:1033
ID:007F
ID:1033
ID:00BC
ID:1033
ID:00BD
ID:1033
RT_VERSION
ID:0001
ID:1033
vcruntime140.dll
[Authenticode]_6dc9e549.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
fothk
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
vcruntime140_1.dll
[Authenticode]_ab80c80e.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
vcruntime140_threads.dll
[Authenticode]_f486df5e.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
PDFSkills.Belongings.update_task.ps1
PDFSkills.Belongings.update_task_ad.ps1
PDFSkills.Belongings.favicon.ico
PDFSkills.Belongings.Uninstall.exe
[Authenticode]_131085ad.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
PDFSkills.Belongings.PDFSkillsApp.exe
[Authenticode]_51271fb6.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
PDFSkillsApp.g.resources
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Authenticode present at 0x22D200 size 11992 bytes
Info

PDB Path: ?
Module Name

PDFSkills.exe
Full Name

PDFSkills.exe
EntryPoint

System.Void PDFSkills.App::Main()
Scope Name

PDFSkills.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

PDFSkills
Assembly Version

247.8.41.106
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

125
Main Method

System.Void PDFSkills.App::Main()
Main IL Instruction Count

4
Main IL

newobj System.Void PDFSkills.App::.ctor() callvirt System.Int32 System.Windows.Application::Run() pop <null> ret <null>
d1aad5e46b5659869ec0c7d2bc049a9d (2.29 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙