Deep Malware Analysis of f3ac3bb5adc82794b1430929dad5f6d6 | md5: f3ac3bb5adc82794b1430929dad5f6d6 | Executable | PE (Portable Executable) | PE File Layout | Win 64 Exe | x64 | PDB Path | Managed .NET | .Net | SOS: 0.21 | SOS: 0.20 | SOS: 0.92

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	f3ac3bb5adc82794b1430929dad5f6d6
Sha1	9719182a9d538417e43d34fe420baee08b723037
Sha256	b3c023cc4dd7a59b9dbd9e0e352d82d3b8a8fba0da89a47805693c0d482c184d
Sha384	01053993f4d56930663dcdef539cb15b69af8a63216bbf7cdc7bb003d86924dac0415176661a65e2dfa4fd5b30459000
Sha512	d9414ffa05be940d3281fa9df0081609542297ac6a2cfb1679d4ecfb45c45fc8243b731dd3602074a160494fe03df0048a09d45f986efa1dbbf10563d11c6178
SSDeep	98304:06IDxUZKdU9XRN6xVcGTFK0QxzVAVrky8YeGUThH62UH3lsW5CVbJNDEuy0u6:0LxbU9XX6QQYlzVAVrkygdTGXlYrEug6
TLSH	EF362304ABA1316AFCB39674CEB3C6E1DA313C46435196EB27E4645B0EFB1D1CB2A711

PeID

Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikon

f3ac3bb5adc82794b1430929dad5f6d6

Executable

PE (Portable Executable)

Overlay_407c9106.bin

PE (Portable Executable)

OpenLink.ps1

ae_mixtwo_2.exe

PE (Portable Executable)

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:0

RT_MANIFEST

ID:0001

ID:0

.Net Resources

HomagConnect.ProductionManager.Contracts.Orders.OrderActionDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Orders.UsageDetailsPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Orders.UsageOverviewPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemFeedbackActionDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemFeedbackDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemStatusDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionItems.ProductionItemTypeDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionProtocol.ProcessedItemCategoryDisplayNames.resources

HomagConnect.ProductionManager.Contracts.ProductionProtocol.ProductionProtocolPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkCategoryDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkPropertyDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkReasonDisplayNames.resources

HomagConnect.ProductionManager.Contracts.Rework.ReworkStateDisplayNames.resources

HomagConnect.ProductionManager.Contracts.WorkstationYield.WorkstationYieldPropertyNames.resources

LfdReader.dll

Executable

PE (Portable Executable)

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.reloc

.rsrc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

IBar2Double&&

LX_Naspb0sNo0zyrCb.zip

Zip Archive

Executable

PE (Portable Executable)

re21.exe

PE (Portable Executable)

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rsrc

Resources

RT_VERSION

ID:0001

ID:0

.Net Resources

ILRepack.List

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

.didat

.fptable

.rsrc

.reloc

Resources

PNG

ID:0065

ID:1033

ID:1033-preview.png

ID:0066

ID:1033

ID:1033-preview.png

RT_ICON

ID:0001

ID:1033

ID:0002

ID:1033

ID:0003

ID:1033

ID:0004

ID:1033

ID:0005

ID:1033

ID:0006

ID:1033

ID:0007

ID:1033

ID:1033-preview.png

RT_DIALOG

ID:0000

ID:1033

RT_STRING

ID:0007

ID:1033

ID:0008

ID:1033

ID:0009

ID:1033

ID:000A

ID:1033

ID:000B

ID:1033

ID:000C

ID:1033

ID:000D

ID:1033

ID:000E

ID:1033

ID:000F

ID:1033

ID:0010

ID:1033

ID:0011

ID:1033

RT_GROUP_CURSOR4

ID:0064

ID:1033

RT_MANIFEST

ID:0001

ID:1033

STICH beta

No STICH Path has been generated for this analysis yet.

9 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 8img 1

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Overlay extracted: Overlay_407c9106.bin (4700843 bytes)
Info	PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb