Malicious
Malicious

f3af39c8bb5054272971c1654c11c8f9

PE Executable
|
MD5: f3af39c8bb5054272971c1654c11c8f9
|
Size: 24.64 MB
|
application/x-msdownload

Executable
PE (Portable Executable)
Win 32 Exe
x86
Obfuscated
VBScript Encoded
.Net Obfuscator
.Net Reactor
.Net
PDB Path
WScript.Shell
SOS: 0.99
Print
General
Structural Analysis
Config.0
Yara Rules99+
Sync
Community
Infection Chain
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
f3af39c8bb5054272971c1654c11c8f9
Sha1
ad1cdfe3f6acd4cf8f8068ad1912513abe5ef083
Sha256
2bd47169f12b74684dabf4e2937ca6e046e1774a2b090324a00feba5158f146d
Sha384
aa535237ded594055bb485e43782073056d423a906bfc24ca28a15821ec80b202b720e4da7b61347aa8777468b0ec4b2
Sha512
6bc8b3ef9fdd75f560c7e2a4402982769c4c8fecb0a813791ce44455a983231cbe39bc0c8e096d8025d88bd4bbccf3829395c752a27fcca5dec3847bbb063a96
SSDeep
393216:SN3eETMNp6MU6fpU8S28pZPvvlEJGiw9Bvgj/FLHG8x8Oq3rm7SgQWnhFOIMHBp1:SN3eETMNp6+RU8S28pZvlpve/FLm8x8X
TLSH
8E47F0003F608513F0C4C1F282B9BEF7077998301B659297E5A9F7E9D525FC26EA8786

PeID

Borland Delphi 7 - Nstd EP - ASL sign
Microsoft Visual C++ 6.0 DLL (Debug)
Microsoft Visual C++ 7.0 - 8.0
Microsoft Visual C++ v6.0 DLL
UPolyX 0.3 -> delikon
File Structure
f3af39c8bb5054272971c1654c11c8f9
Executable
PE (Portable Executable)
Win 32 Exe
x86
Obfuscated
VBScript Encoded
.Net Obfuscator
.Net Reactor
.Net
PDB Path
WScript.Shell
SOS: 0.99
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc
Resources
RT_ICON
ID:0032
ID:0
RT_RCDATA
ID:0000
ID:0
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc
j ;9m
.text
.data
.didat
Resources
RT_RCDATA
ID:0000
ID:0
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
.didat
Resources
RT_ICON
ID:0001
ID:1033
ID:1024
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
RT_DIALOG
ID:02BC
ID:1033
ID:02BD
ID:1033
ID:02BE
ID:1033
ID:02BF
ID:1033
ID:02C0
ID:1033
ID:02C1
ID:1033
ID:0000
ID:1033
RT_STRING
ID:0001
ID:1033
ID:0002
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
ID:000E
ID:1033
ID:000F
ID:1033
ID:0010
ID:1033
RT_GROUP_CURSOR4
ID:0064
ID:1033
ID:1024
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
PNG
ID:0065
ID:1033
ID:1033-preview.png
ID:0066
ID:1033
ID:1033-preview.png
RT_ICON
ID:0001
ID:0
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:1033-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:0
ID:0064
ID:1033
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
ID:0.decoded.vbs
Visual Basic
VBScript
VBScript Encoded
WScript.Shell
Malicious
RT_GROUP_CURSOR4
ID:0000
ID:0
f3af39c8bb5054272971c1654c11c8f9.decoded.vbs
Visual Basic
VBScript
VBScript Encoded
WScript.Shell
Malicious
Artefacts
Name
 Value
URLs in VB Code - #1

http://www.clickteam.com
URLs in VB Code - #2

http://www.clickteam.com/pub
URLs in VB Code - #3

http://schemas.microsoft.com/SMI/2005/WindowsSettings
URLs in VB Code - #1

http://www.clickteam.com
URLs in VB Code - #2

http://www.clickteam.com/pub
URLs in VB Code - #3

http://schemas.microsoft.com/SMI/2005/WindowsSettings
PDB Path

t$di
PDB Path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
URLs in VB Code - #1

http://schemas.microsoft.com/SMI/2005/WindowsSettings
PDB Path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
f3af39c8bb5054272971c1654c11c8f9 (24.64 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙