Suspicious
Suspect

f292c0911456c1d9c40d5740c7d3997f

PE Executable
|
MD5: f292c0911456c1d9c40d5740c7d3997f
|
Size: 16.63 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
f292c0911456c1d9c40d5740c7d3997f
Sha1
648d36439c4adba0d6ec4c169860da175ab2ac9c
Sha256
a451cbfe093830cd4d907d10bc0f27ea51da53ece5456af2fe6b3b24d3df163e
Sha384
849de85b0bc5296a4f1963e3b937ae2a7cdae8c392d3936290166cdf632c5eb397fa27c0e7ccb8679fd814d760b1f26e
Sha512
4dbc87182c30ce09df46b8ed8eebc69f91f4af3a2714df6b37958d4be633e9198bc47e97900c0868e98af7150b6365c4a26437167b5887e64145000104b59109
SSDeep
196608:WVWPgXEkEEUlX+5pylxvT2auxo7xSwT0t9Ca2NWJk6oImvl7J8Zk3W1u:aW2EkwlXKW5ui7xtT0uZWYCZkG1u
TLSH
76F61270DDB25A42FFD773F7B1FEF6B2E46E50BA21044512E1C8A99B4480F15C98A42E

PeID

Microsoft Visual C++ v6.0 DLL
UPolyX 0.3 -> delikon
File Structure
f292c0911456c1d9c40d5740c7d3997f
[Authenticode]_a54fa282.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
RT_RCDATA
ID:0000
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Authenticode present at 0xFD9400 size 9784 bytes
Info

PDB Path: $XCU
Artefacts
Name
 Value
URLs in VB Code - #1

http://schemas.microsoft.com/SMI/2005/WindowsSettings
URLs in VB Code - #2

http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
URLs in VB Code - #3

http://ocsps.ssl.com0
URLs in VB Code - #4

http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
URLs in VB Code - #5

http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0
URLs in VB Code - #6

http://ocsps.ssl.com0P
URLs in VB Code - #7

https://www.ssl.com/repository0
URLs in VB Code - #8

http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
URLs in VB Code - #9

http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
URLs in VB Code - #10

http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
URLs in VB Code - #11

http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
URLs in VB Code - #12

http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
f292c0911456c1d9c40d5740c7d3997f (16.63 MB)
File Structure
f292c0911456c1d9c40d5740c7d3997f
[Authenticode]_a54fa282.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
RT_RCDATA
ID:0000
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
URLs in VB Code - #1

http://schemas.microsoft.com/SMI/2005/WindowsSettings

f292c0911456c1d9c40d5740c7d3997f
URLs in VB Code - #2

http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0

f292c0911456c1d9c40d5740c7d3997f
URLs in VB Code - #3

http://ocsps.ssl.com0

f292c0911456c1d9c40d5740c7d3997f
URLs in VB Code - #4

http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0

f292c0911456c1d9c40d5740c7d3997f
URLs in VB Code - #5

http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0

f292c0911456c1d9c40d5740c7d3997f
URLs in VB Code - #6

http://ocsps.ssl.com0P

f292c0911456c1d9c40d5740c7d3997f
URLs in VB Code - #7

https://www.ssl.com/repository0

f292c0911456c1d9c40d5740c7d3997f
URLs in VB Code - #8

http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0

f292c0911456c1d9c40d5740c7d3997f
URLs in VB Code - #9

http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q

f292c0911456c1d9c40d5740c7d3997f
URLs in VB Code - #10

http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0

f292c0911456c1d9c40d5740c7d3997f
URLs in VB Code - #11

http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0

f292c0911456c1d9c40d5740c7d3997f
URLs in VB Code - #12

http://crls.ssl.com/ssl.com-rsa-RootCA.crl0

f292c0911456c1d9c40d5740c7d3997f
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙