Malicious
PE Executable
MD5: d9def5aed3d0701634ed3ad6b66b9bf7
Size: 1.17 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Encoded VBScript file
Size
1.17 MB · 1,166,476 B
First seen
2026-01-20 12:16 · 9 months ago
Last seen
2026-01-20 12:16 · 9 months ago
Last analysis
2026-01-20 12:16 · 9 months ago
Hashes
MD5
d9def5aed3d0701634ed3ad6b66b9bf7
Sha1
fe5ca7448b1353eb9e2a7b146a77451f0af6ebd8
Sha256
75aad50d7df8e668fe606669881d088323263e4c6ed6931d7615da9770904f03
Sha384
a60dc7fad26d1a458dc576f6da5fede5f0164d58dcdc16eae491b60db1b88004134f8e1e2797145453a636967e7c6d23
Sha512
24976c9a8ba335693290f895e68b7472006062b13f97aafe777fd2ea81ff2e773a99c782c0667a1787643c6dcc5099d0853d2e34e1459de1756a987b940e6272
SSDeep
24576:U2G/nvxW3Ww0tTLHxOHRLV2T7kRlBYyMUpHbwMy:UbA30nW3lb4
TLSH
4A454A017E44CA11F0191633C2EF464847B9AC516AA6E72FBEBA376D55123E37C0DACB
Detection
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
4 malicious · 34 files
EXEd9def5aed3d0701634ed3ad6b66b9bf7
Structure
VBSOverlay_c0907651.bin
BAT1QKgJoXr.bat
EXEPortSession.exe
Structure
BINResources
BIN.Net Resources
VBSLPId5eNTzgrWPb4a9ev1VMyUNPz0.vbe
BINResources
VBSd9def5aed3d0701634ed3ad6b66b9bf7.decoded.vbs
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_c0907651.bin (850060 bytes) |
| Info | PDB Path: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb |