Suspicious
Suspect

e8ab33009ef7f35022e2df1585073680

PE Executable
|
MD5: e8ab33009ef7f35022e2df1585073680
|
Size: 12.14 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
e8ab33009ef7f35022e2df1585073680
Sha1
23ab91ab0738a6db4f0ac9186a5355667cefed41
Sha256
17f1957752f234a9bda043a5e2e36999a0b40aad118de4b3fe0de84c615a63df
Sha384
7d9b1c340197d8fd119b4acf8199ef930ca225aee3805680e33b35f35e4f124e1f14c93a61ab9703cf917bd53c8169d0
Sha512
bde89c96cfdbc28432ef39060b9a7077c5a29fa0776408d964bb8e1e4bcd43e058b64b3392762419bd0bf5d0dd235b8f28e71b0d00c2415bf82881e5ed5be686
SSDeep
196608:lTvoKgpK3PtEGyn7LoRb5gMeZ+T4L5PUitgSaDm+t71KdNyr/6G:hvdbEGEL6aMe/2khiKdYbX
TLSH
66C61273F245A43EC4EF2A3A897BA714693FBE51A902CD4A53F0354CCE751802A7B647

PeID

BobSoft Mini Delphi -> BoB / BobSoft
Borland Delphi 2006
Borland Delphi 2006 - 2007
Borland Delphi 4.0
Borland Delphi v3.0
Borland Delphi v3.0
Borland Delphi v3.0 - v7.0
Borland Delphi v6.0 - v7.0
Borland Delphi v6.0 - v7.0
Microsoft Visual C++ v6.0 DLL
Pe123 v2006.4.4-4.12
UPolyX 0.3 -> delikon
File Structure
e8ab33009ef7f35022e2df1585073680
[Authenticode]_394584fe.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.itext
.data
.bss
.idata
.didata
.edata
.tls
.rdata
.reloc
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
RT_STRING
ID:0FEE
ID:0
ID:0FEF
ID:0
ID:0FF0
ID:0
ID:0FF1
ID:0
ID:0FF2
ID:0
ID:0FF3
ID:0
ID:0FF4
ID:0
ID:0FF5
ID:0
ID:0FF6
ID:0
ID:0FF7
ID:0
ID:0FF8
ID:0
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFC
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
ID:1000
ID:0
RT_RCDATA
ID:0000
ID:0
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Authenticode present at 0xB93800 size 6128 bytes
Artefacts
Name
 Value
URLs in VB Code - #1

http://schemas.microsoft.com/SMI/2005/WindowsSettings
URLs in VB Code - #2

http://ocsp.thawte.com0
URLs in VB Code - #3

http://crl.thawte.com/ThawteTimestampingCA.crl0
URLs in VB Code - #4

http://ts-ocsp.ws.symantec.com07
URLs in VB Code - #5

http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
URLs in VB Code - #6

http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
URLs in VB Code - #7

http://crl3.digicert.com/sha2-assured-cs-g1.crl05
URLs in VB Code - #8

http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
URLs in VB Code - #9

https://www.digicert.com/CPS0
URLs in VB Code - #10

http://ocsp.digicert.com0N
URLs in VB Code - #11

http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
URLs in VB Code - #12

http://ocsp.digicert.com0C
URLs in VB Code - #13

http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
URLs in VB Code - #14

http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
URLs in VB Code - #15

http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
e8ab33009ef7f35022e2df1585073680 (12.14 MB)
File Structure
e8ab33009ef7f35022e2df1585073680
[Authenticode]_394584fe.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.itext
.data
.bss
.idata
.didata
.edata
.tls
.rdata
.reloc
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
RT_STRING
ID:0FEE
ID:0
ID:0FEF
ID:0
ID:0FF0
ID:0
ID:0FF1
ID:0
ID:0FF2
ID:0
ID:0FF3
ID:0
ID:0FF4
ID:0
ID:0FF5
ID:0
ID:0FF6
ID:0
ID:0FF7
ID:0
ID:0FF8
ID:0
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFC
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
ID:1000
ID:0
RT_RCDATA
ID:0000
ID:0
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
URLs in VB Code - #1

http://schemas.microsoft.com/SMI/2005/WindowsSettings

e8ab33009ef7f35022e2df1585073680
URLs in VB Code - #2

http://ocsp.thawte.com0

e8ab33009ef7f35022e2df1585073680
URLs in VB Code - #3

http://crl.thawte.com/ThawteTimestampingCA.crl0

e8ab33009ef7f35022e2df1585073680
URLs in VB Code - #4

http://ts-ocsp.ws.symantec.com07

e8ab33009ef7f35022e2df1585073680
URLs in VB Code - #5

http://ts-aia.ws.symantec.com/tss-ca-g2.cer0

e8ab33009ef7f35022e2df1585073680
URLs in VB Code - #6

http://ts-crl.ws.symantec.com/tss-ca-g2.crl0

e8ab33009ef7f35022e2df1585073680
URLs in VB Code - #7

http://crl3.digicert.com/sha2-assured-cs-g1.crl05

e8ab33009ef7f35022e2df1585073680
URLs in VB Code - #8

http://crl4.digicert.com/sha2-assured-cs-g1.crl0L

e8ab33009ef7f35022e2df1585073680
URLs in VB Code - #9

https://www.digicert.com/CPS0

e8ab33009ef7f35022e2df1585073680
URLs in VB Code - #10

http://ocsp.digicert.com0N

e8ab33009ef7f35022e2df1585073680
URLs in VB Code - #11

http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0

e8ab33009ef7f35022e2df1585073680
URLs in VB Code - #12

http://ocsp.digicert.com0C

e8ab33009ef7f35022e2df1585073680
URLs in VB Code - #13

http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0

e8ab33009ef7f35022e2df1585073680
URLs in VB Code - #14

http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0

e8ab33009ef7f35022e2df1585073680
URLs in VB Code - #15

http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O

e8ab33009ef7f35022e2df1585073680
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙