Malicious
Malicious

d4e975e533afeb1e1a628a22a9374fa7

PE Executable
MD5: d4e975e533afeb1e1a628a22a9374fa7
Size: 593.92 KB
application/x-dosexec
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
d4e975e533afeb1e1a628a22a9374fa7
Sha1
76d041239c4b8a6978904788a9323f478e3d7186
Sha256
5aa5714bdc3806c375077d41562ecc6934279b11ca41623a4ff83fb237aacd2f
Sha384
663ae992775d70b8cd28771fb4f5111898b49d30542fe5e6e37da003bcdcc9b9bbf07624ea5d93fb847ec613a889db88
Sha512
1a8fd8cbacbc4ef82b99a111daf3278290a36b93d6ee18389038e82e632d00520e872a8f6c38e8cb4d60d432be8e3aeb8686d283de8f90fe224efde1ae43cb20
SSDeep
12288:81y90qgc+jXed6nZ6tj2rhbj76aQR5nUFpQLnWai:EylIjER2rdj76OYWai
TLSH
43C4010B6BE960A2F4B5937489F203D30674BC71672582FF16CADA3D1E236F06235B56

PeID

Microsoft Visual C++ 8.0 (DLL)
File Structure
d4e975e533afeb1e1a628a22a9374fa7
Malicious
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
fothk
.rdata
.data
.pdata
.rsrc
.reloc
Resources
Malicious
AVI
ID:0BB9
ID:1033
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:1033-preview.png
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
RT_DIALOG
ID:07D1
ID:1033
ID:1049
ID:07D2
ID:1033
ID:1049
ID:07D3
ID:1033
ID:1049
ID:07D4
ID:1033
ID:1049
ID:07D5
ID:1033
ID:1049
ID:07D6
ID:1033
ID:1049
RT_STRING
ID:003F
ID:1033
ID:1049
ID:004C
ID:1033
ID:1049
ID:004D
ID:1033
ID:1049
ID:0050
ID:1033
ID:1049
ID:0053
ID:1033
ID:1049
ID:0055
ID:1033
ID:1049
RT_RCDATA
Malicious
ID:0000
Malicious
ID:1033
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
RT_GROUP_CURSOR4
ID:0BB8
ID:1033
RT_VERSION
ID:0001
ID:1033
ID:1049
RT_MANIFEST
ID:0001
ID:1033
Codex Installer.exe
[Authenticode]_4af71dc6.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0-preview.png
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0-preview.png
ID:0006
ID:0
ID:0-preview.png
ID:0007
ID:0
ID:0-preview.png
ID:0008
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
StoreInstaller.g.resources
StoreInstaller.Resources.Strings.af_ZA.Strings.resources
StoreInstaller.Resources.Strings.am_ET.Strings.resources
StoreInstaller.Resources.Strings.ar_SA.Strings.resources
StoreInstaller.Resources.Strings.as_IN.Strings.resources
StoreInstaller.Resources.Strings.az_Latn_AZ.Strings.resources
StoreInstaller.Resources.Strings.bg_BG.Strings.resources
StoreInstaller.Resources.Strings.bn_IN.Strings.resources
StoreInstaller.Resources.Strings.bs_Latn_BA.Strings.resources
StoreInstaller.Resources.Strings.ca_Es_VALENCIA.Strings.resources
StoreInstaller.Resources.Strings.ca_ES.Strings.resources
StoreInstaller.Resources.Strings.cs_CZ.Strings.resources
StoreInstaller.Resources.Strings.cy_GB.Strings.resources
StoreInstaller.Resources.Strings.da_DK.Strings.resources
StoreInstaller.Resources.Strings.de_DE.Strings.resources
StoreInstaller.Resources.Strings.el_GR.Strings.resources
StoreInstaller.Resources.Strings.en_GB.Strings.resources
StoreInstaller.Resources.Strings.en_US.Strings.resources
StoreInstaller.Resources.Strings.es_ES.Strings.resources
StoreInstaller.Resources.Strings.es_MX.Strings.resources
StoreInstaller.Resources.Strings.et_EE.Strings.resources
StoreInstaller.Resources.Strings.eu_ES.Strings.resources
StoreInstaller.Resources.Strings.fa_IR.Strings.resources
StoreInstaller.Resources.Strings.fi_FI.Strings.resources
StoreInstaller.Resources.Strings.fil_PH.Strings.resources
StoreInstaller.Resources.Strings.fr_CA.Strings.resources
StoreInstaller.Resources.Strings.fr_FR.Strings.resources
StoreInstaller.Resources.Strings.ga_IE.Strings.resources
StoreInstaller.Resources.Strings.gd_gb.Strings.resources
StoreInstaller.Resources.Strings.gl_ES.Strings.resources
StoreInstaller.Resources.Strings.gu_IN.Strings.resources
StoreInstaller.Resources.Strings.he_IL.Strings.resources
StoreInstaller.Resources.Strings.hi_IN.Strings.resources
StoreInstaller.Resources.Strings.hr_HR.Strings.resources
StoreInstaller.Resources.Strings.hu_HU.Strings.resources
StoreInstaller.Resources.Strings.hy_AM.Strings.resources
StoreInstaller.Resources.Strings.id_ID.Strings.resources
StoreInstaller.Resources.Strings.is_IS.Strings.resources
StoreInstaller.Resources.Strings.it_IT.Strings.resources
StoreInstaller.Resources.Strings.ja_JP.Strings.resources
StoreInstaller.Resources.Strings.ka_GE.Strings.resources
StoreInstaller.Resources.Strings.kk_KZ.Strings.resources
StoreInstaller.Resources.Strings.km_KH.Strings.resources
StoreInstaller.Resources.Strings.kn_IN.Strings.resources
StoreInstaller.Resources.Strings.ko_KR.Strings.resources
StoreInstaller.Resources.Strings.kok_IN.Strings.resources
StoreInstaller.Resources.Strings.lb_LU.Strings.resources
StoreInstaller.Resources.Strings.lo_LA.Strings.resources
StoreInstaller.Resources.Strings.lt_LT.Strings.resources
StoreInstaller.Resources.Strings.lv_LV.Strings.resources
StoreInstaller.Resources.Strings.mi_NZ.Strings.resources
StoreInstaller.Resources.Strings.mk_MK.Strings.resources
StoreInstaller.Resources.Strings.ml_IN.Strings.resources
StoreInstaller.Resources.Strings.mr_IN.Strings.resources
StoreInstaller.Resources.Strings.ms_MY.Strings.resources
StoreInstaller.Resources.Strings.mt_MT.Strings.resources
StoreInstaller.Resources.Strings.nb_NO.Strings.resources
StoreInstaller.Resources.Strings.ne_NP.Strings.resources
StoreInstaller.Resources.Strings.nl_NL.Strings.resources
StoreInstaller.Resources.Strings.nn_NO.Strings.resources
StoreInstaller.Resources.Strings.or_IN.Strings.resources
StoreInstaller.Resources.Strings.pa_IN.Strings.resources
StoreInstaller.Resources.Strings.pl_PL.Strings.resources
StoreInstaller.Resources.Strings.pt_BR.Strings.resources
StoreInstaller.Resources.Strings.pt_PT.Strings.resources
StoreInstaller.Resources.Strings.quz_PE.Strings.resources
StoreInstaller.Resources.Strings.ro_RO.Strings.resources
StoreInstaller.Resources.Strings.ru_RU.Strings.resources
StoreInstaller.Resources.Strings.sk_SK.Strings.resources
StoreInstaller.Resources.Strings.sl_SI.Strings.resources
StoreInstaller.Resources.Strings.sq_AL.Strings.resources
StoreInstaller.Resources.Strings.sr_Cyrl_BA.Strings.resources
StoreInstaller.Resources.Strings.sr_Cyrl_RS.Strings.resources
StoreInstaller.Resources.Strings.sr_Latn_RS.Strings.resources
StoreInstaller.Resources.Strings.sv_SE.Strings.resources
StoreInstaller.Resources.Strings.ta_IN.Strings.resources
StoreInstaller.Resources.Strings.te_IN.Strings.resources
StoreInstaller.Resources.Strings.th_TH.Strings.resources
StoreInstaller.Resources.Strings.tr_TR.Strings.resources
StoreInstaller.Resources.Strings.tt_RU.Strings.resources
StoreInstaller.Resources.Strings.ug_CN.Strings.resources
StoreInstaller.Resources.Strings.uk_UA.Strings.resources
StoreInstaller.Resources.Strings.ur_PK.Strings.resources
StoreInstaller.Resources.Strings.uz_Latn_UZ.Strings.resources
StoreInstaller.Resources.Strings.vi_VN.Strings.resources
StoreInstaller.Resources.Strings.zh_CN.Strings.resources
StoreInstaller.Resources.Strings.zh_TW.Strings.resources
StoreInstaller.Resources.StoreInstallerPublicKey.bin
StoreInstaller.Resources.Microsoft.Management.Deployment.bin
[Authenticode]_6db1f340.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
StoreInstaller.Resources.Microsoft.Services.Store.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

PDB Path: wextract.pdb
Artefacts
Name
 Value
Deobfuscated PowerShell
Invokehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
Invokehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys…) are available with Essential.
Unlock with Essential
d4e975e533afeb1e1a628a22a9374fa7 (593.92 KB)
File Structure
d4e975e533afeb1e1a628a22a9374fa7
Malicious
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
fothk
.rdata
.data
.pdata
.rsrc
.reloc
Resources
Malicious
AVI
ID:0BB9
ID:1033
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:1033-preview.png
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
RT_DIALOG
ID:07D1
ID:1033
ID:1049
ID:07D2
ID:1033
ID:1049
ID:07D3
ID:1033
ID:1049
ID:07D4
ID:1033
ID:1049
ID:07D5
ID:1033
ID:1049
ID:07D6
ID:1033
ID:1049
RT_STRING
ID:003F
ID:1033
ID:1049
ID:004C
ID:1033
ID:1049
ID:004D
ID:1033
ID:1049
ID:0050
ID:1033
ID:1049
ID:0053
ID:1033
ID:1049
ID:0055
ID:1033
ID:1049
RT_RCDATA
Malicious
ID:0000
Malicious
ID:1033
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
RT_GROUP_CURSOR4
ID:0BB8
ID:1033
RT_VERSION
ID:0001
ID:1033
ID:1049
RT_MANIFEST
ID:0001
ID:1033
Codex Installer.exe
[Authenticode]_4af71dc6.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0-preview.png
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0-preview.png
ID:0006
ID:0
ID:0-preview.png
ID:0007
ID:0
ID:0-preview.png
ID:0008
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
StoreInstaller.g.resources
StoreInstaller.Resources.Strings.af_ZA.Strings.resources
StoreInstaller.Resources.Strings.am_ET.Strings.resources
StoreInstaller.Resources.Strings.ar_SA.Strings.resources
StoreInstaller.Resources.Strings.as_IN.Strings.resources
StoreInstaller.Resources.Strings.az_Latn_AZ.Strings.resources
StoreInstaller.Resources.Strings.bg_BG.Strings.resources
StoreInstaller.Resources.Strings.bn_IN.Strings.resources
StoreInstaller.Resources.Strings.bs_Latn_BA.Strings.resources
StoreInstaller.Resources.Strings.ca_Es_VALENCIA.Strings.resources
StoreInstaller.Resources.Strings.ca_ES.Strings.resources
StoreInstaller.Resources.Strings.cs_CZ.Strings.resources
StoreInstaller.Resources.Strings.cy_GB.Strings.resources
StoreInstaller.Resources.Strings.da_DK.Strings.resources
StoreInstaller.Resources.Strings.de_DE.Strings.resources
StoreInstaller.Resources.Strings.el_GR.Strings.resources
StoreInstaller.Resources.Strings.en_GB.Strings.resources
StoreInstaller.Resources.Strings.en_US.Strings.resources
StoreInstaller.Resources.Strings.es_ES.Strings.resources
StoreInstaller.Resources.Strings.es_MX.Strings.resources
StoreInstaller.Resources.Strings.et_EE.Strings.resources
StoreInstaller.Resources.Strings.eu_ES.Strings.resources
StoreInstaller.Resources.Strings.fa_IR.Strings.resources
StoreInstaller.Resources.Strings.fi_FI.Strings.resources
StoreInstaller.Resources.Strings.fil_PH.Strings.resources
StoreInstaller.Resources.Strings.fr_CA.Strings.resources
StoreInstaller.Resources.Strings.fr_FR.Strings.resources
StoreInstaller.Resources.Strings.ga_IE.Strings.resources
StoreInstaller.Resources.Strings.gd_gb.Strings.resources
StoreInstaller.Resources.Strings.gl_ES.Strings.resources
StoreInstaller.Resources.Strings.gu_IN.Strings.resources
StoreInstaller.Resources.Strings.he_IL.Strings.resources
StoreInstaller.Resources.Strings.hi_IN.Strings.resources
StoreInstaller.Resources.Strings.hr_HR.Strings.resources
StoreInstaller.Resources.Strings.hu_HU.Strings.resources
StoreInstaller.Resources.Strings.hy_AM.Strings.resources
StoreInstaller.Resources.Strings.id_ID.Strings.resources
StoreInstaller.Resources.Strings.is_IS.Strings.resources
StoreInstaller.Resources.Strings.it_IT.Strings.resources
StoreInstaller.Resources.Strings.ja_JP.Strings.resources
StoreInstaller.Resources.Strings.ka_GE.Strings.resources
StoreInstaller.Resources.Strings.kk_KZ.Strings.resources
StoreInstaller.Resources.Strings.km_KH.Strings.resources
StoreInstaller.Resources.Strings.kn_IN.Strings.resources
StoreInstaller.Resources.Strings.ko_KR.Strings.resources
StoreInstaller.Resources.Strings.kok_IN.Strings.resources
StoreInstaller.Resources.Strings.lb_LU.Strings.resources
StoreInstaller.Resources.Strings.lo_LA.Strings.resources
StoreInstaller.Resources.Strings.lt_LT.Strings.resources
StoreInstaller.Resources.Strings.lv_LV.Strings.resources
StoreInstaller.Resources.Strings.mi_NZ.Strings.resources
StoreInstaller.Resources.Strings.mk_MK.Strings.resources
StoreInstaller.Resources.Strings.ml_IN.Strings.resources
StoreInstaller.Resources.Strings.mr_IN.Strings.resources
StoreInstaller.Resources.Strings.ms_MY.Strings.resources
StoreInstaller.Resources.Strings.mt_MT.Strings.resources
StoreInstaller.Resources.Strings.nb_NO.Strings.resources
StoreInstaller.Resources.Strings.ne_NP.Strings.resources
StoreInstaller.Resources.Strings.nl_NL.Strings.resources
StoreInstaller.Resources.Strings.nn_NO.Strings.resources
StoreInstaller.Resources.Strings.or_IN.Strings.resources
StoreInstaller.Resources.Strings.pa_IN.Strings.resources
StoreInstaller.Resources.Strings.pl_PL.Strings.resources
StoreInstaller.Resources.Strings.pt_BR.Strings.resources
StoreInstaller.Resources.Strings.pt_PT.Strings.resources
StoreInstaller.Resources.Strings.quz_PE.Strings.resources
StoreInstaller.Resources.Strings.ro_RO.Strings.resources
StoreInstaller.Resources.Strings.ru_RU.Strings.resources
StoreInstaller.Resources.Strings.sk_SK.Strings.resources
StoreInstaller.Resources.Strings.sl_SI.Strings.resources
StoreInstaller.Resources.Strings.sq_AL.Strings.resources
StoreInstaller.Resources.Strings.sr_Cyrl_BA.Strings.resources
StoreInstaller.Resources.Strings.sr_Cyrl_RS.Strings.resources
StoreInstaller.Resources.Strings.sr_Latn_RS.Strings.resources
StoreInstaller.Resources.Strings.sv_SE.Strings.resources
StoreInstaller.Resources.Strings.ta_IN.Strings.resources
StoreInstaller.Resources.Strings.te_IN.Strings.resources
StoreInstaller.Resources.Strings.th_TH.Strings.resources
StoreInstaller.Resources.Strings.tr_TR.Strings.resources
StoreInstaller.Resources.Strings.tt_RU.Strings.resources
StoreInstaller.Resources.Strings.ug_CN.Strings.resources
StoreInstaller.Resources.Strings.uk_UA.Strings.resources
StoreInstaller.Resources.Strings.ur_PK.Strings.resources
StoreInstaller.Resources.Strings.uz_Latn_UZ.Strings.resources
StoreInstaller.Resources.Strings.vi_VN.Strings.resources
StoreInstaller.Resources.Strings.zh_CN.Strings.resources
StoreInstaller.Resources.Strings.zh_TW.Strings.resources
StoreInstaller.Resources.StoreInstallerPublicKey.bin
StoreInstaller.Resources.Microsoft.Management.Deployment.bin
[Authenticode]_6db1f340.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
StoreInstaller.Resources.Microsoft.Services.Store.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
Deobfuscated PowerShell
Invokehuhuhuhuhuhuhuhuhuhuhu
Malicious

d4e975e533afeb1e1a628a22a9374fa7 > Resources > RT_RCDATA > ID:0000 > ID:1033 > [PowerShell Command]
Deobfuscated PowerShell
Invokehuhuhuhuhuhuhuhuhuhuhu
Malicious

d4e975e533afeb1e1a628a22a9374fa7 > Resources > RT_RCDATA > ID:0000 > ID:1033 > [PowerShell Command] > [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys…) are available with Essential.
Unlock with Essential
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙