Suspicious
Suspect

e4c9215ceac03dde05155c4fb667f69c

PE Executable
|
MD5: e4c9215ceac03dde05155c4fb667f69c
|
Size: 1.92 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics
Hash
Hash Value
MD5
e4c9215ceac03dde05155c4fb667f69c
Sha1
c61c604cd8d28c97a56d149ae7ba70a077cbb890
Sha256
580e6c64ba71bf32dc63c34204dc48d17ff8de949c916f101e89472222b41a88
Sha384
032507d21164dbfe2c394c802441499aee6ae6564b067b62d6140c6689e234832acbf0b5fc115b4892ce10dd5c2fd4d8
Sha512
4a794a4dbb05a50e1e0fbe8effa7ebb9a2a5e6a8c086f337121ae7930dc7b955fe2f92639c4d1e77656d9d21c2d6569a980cc0d798a190d41dc0049340dba6bb
SSDeep
49152:8WBj/clJYeXD2liBL7G3eCt0cAvbfVQOlgya:w1XDo0Lq3ft0cybfVQOlgya
TLSH
FA9533A2357849B0F90BA071011935E5C2B5B710BF896BFCC01B9A59DEFB6C0E34DA9D

PeID

Packer=UPX Compresor..Gratuito... www.upx.sourceforge.net
UPX -> www.upx.sourceforge.net
UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John Reiser
UPX Modified >> *$igBy Ahmed18
UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo (overlay)]
UPX v1.25 (Delphi) Stub
UPX v2.0 -> Markus, Laszlo & Reiser
UPX v3.0
UPolyX 0.3 -> delikon
File Structure
[Authenticode]_dde65375.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.rsrc
.reloc
Resources
RT_GROUP_CURSOR4
ID:0000
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
Resources
RT_ICON
ID:0001
ID:2052
ID:0002
ID:2052
ID:0003
ID:2052
ID:0004
ID:2052
RT_DIALOG
ID:0064
ID:2052
ID:0066
ID:2052
RT_STRING
ID:0007
ID:2052
RT_GROUP_CURSOR4
ID:0080
ID:2052
ID:0081
ID:2052
ID:0082
ID:2052
ID:0085
ID:2052
RT_VERSION
ID:0001
ID:2052
RT_DLGINIT
ID:0066
ID:2052
Overlay_03a5f71c.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
UPX0
UPX1
.rsrc
Resources
SCRIPT
ID:0065
ID:2052
ID:0067
ID:2052
RT_ICON
ID:0032
ID:0
ID:0-preview.png
RT_DIALOG
ID:271B
ID:2052
ID:271C
ID:2052
ID:271D
ID:2052
ID:271E
ID:2052
ID:2720
ID:2052
ID:2723
ID:2052
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:2052
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Info

Overlay extracted: Overlay_03a5f71c.bin (905064 bytes)

e4c9215ceac03dde05155c4fb667f69c (1.92 MB)
File Structure
[Authenticode]_dde65375.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.rsrc
.reloc
Resources
RT_GROUP_CURSOR4
ID:0000
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
Resources
RT_ICON
ID:0001
ID:2052
ID:0002
ID:2052
ID:0003
ID:2052
ID:0004
ID:2052
RT_DIALOG
ID:0064
ID:2052
ID:0066
ID:2052
RT_STRING
ID:0007
ID:2052
RT_GROUP_CURSOR4
ID:0080
ID:2052
ID:0081
ID:2052
ID:0082
ID:2052
ID:0085
ID:2052
RT_VERSION
ID:0001
ID:2052
RT_DLGINIT
ID:0066
ID:2052
Overlay_03a5f71c.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
UPX0
UPX1
.rsrc
Resources
SCRIPT
ID:0065
ID:2052
ID:0067
ID:2052
RT_ICON
ID:0032
ID:0
ID:0-preview.png
RT_DIALOG
ID:271B
ID:2052
ID:271C
ID:2052
ID:271D
ID:2052
ID:271E
ID:2052
ID:2720
ID:2052
ID:2723
ID:2052
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:2052
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙