Suspicious
Suspect

f513a2ed8a51b4b35685410cb50102be

PE Executable
|
MD5: f513a2ed8a51b4b35685410cb50102be
|
Size: 4.33 MB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
f513a2ed8a51b4b35685410cb50102be
Sha1
f17e749e2c637f1bd8318a3bf15473a2b7643c5e
Sha256
6bc1c41e0568a5d2d70731d75713da66273e1e541347e2bb42a20609acb9fa48
Sha384
9dc95acbc20b3abaa849ffe8fd19fdf56de4fbf6818889c1b0f332bdd37af694455c8bfc425acf60f97c5bb3718b4129
Sha512
5707068073926595cc292f4a15e1283729be8baa5ab9771e0d9ee8fb3fe32e8d01a3244715fb94c2b4288f3c7020f319a8ebeb25cba06564038506d303d9a316
SSDeep
98304:zziJr0Hwom0SQ46PYoBqT1DjJsyiYaIySqaW9:zzgr0HLTT7RBqdSxvam
TLSH
D6162315E7E901F9F0B39674CA629D12DAB37C5E033286DF13E457962F272A0DE29321

PeID

Microsoft Visual C++ 8.0 (DLL)
Microsoft Visual C++ v6.0 DLL
Pe123 v2006.4.4-4.12
File Structure
f513a2ed8a51b4b35685410cb50102be
Overlay_40e95a87.bin
1.exe
Overlay_0d284f05.bin
2.exe
[Authenticode]_fcede624.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
ZIPRES
ID:0065
ID:2052
accept_btn.png
accept_btn.png-preview.png
accept_btn_hover.png
accept_btn_hover.png-preview.png
bg.png
bg.png-preview.png
bgExpand.png
bgExpand.png-preview.png
check2_off.png
check2_off.png-preview.png
check2_on.png
check2_on.png-preview.png
check_hover.png
check_hover.png-preview.png
check_off.png
check_off.png-preview.png
check_on.png
check_on.png-preview.png
choose_language_combo.png
choose_language_combo.png-preview.png
choose_language_combo_focus.png
choose_language_combo_focus.png-preview.png
choose_language_combo_hover.png
choose_language_combo_hover.png-preview.png
choose_language_combo_normal.png
choose_language_combo_normal.png-preview.png
close.png
close.png-preview.png
close_d.png
close_d.png-preview.png
folder.png
folder.png-preview.png
hide_click.png
hide_click.png-preview.png
hide_hover.png
hide_hover.png-preview.png
hide_normal.png
hide_normal.png-preview.png
installDialog.xml
install_btn.png
install_btn.png-preview.png
install_btn_hover.png
install_btn_hover.png-preview.png
loginwindowshadow.png
loginwindowshadow.png-preview.png
logo.png
logo.png-preview.png
mask.png
mask.png-preview.png
min.png
min.png-preview.png
min_d.png
min_d.png-preview.png
onlinesetup
0.png
0.png-preview.png
1.png
1.png-preview.png
2.png
2.png-preview.png
3.png
3.png-preview.png
4.png
4.png-preview.png
qrcode_activity.png
qrcode_activity.png-preview.png
options.png
options.png-preview.png
options_expand.png
options_expand.png-preview.png
pageIndex_normal.png
pageIndex_normal.png-preview.png
pageIndex_select.png
pageIndex_select.png-preview.png
progressbar_bg.png
progressbar_bg.png-preview.png
progressbar_end.png
progressbar_end.png-preview.png
progressbar_head.png
progressbar_head.png-preview.png
progressbar_mid.png
progressbar_mid.png-preview.png
Setting_click.png
Setting_click.png-preview.png
Setting_hover.png
Setting_hover.png-preview.png
Setting_nomal.png
Setting_nomal.png-preview.png
skin.xml
warningDialog.xml
ID:0067
ID:2052
check_hover.png
check_hover.png-preview.png
check_off.png
check_off.png-preview.png
check_on.png
check_on.png-preview.png
getstart_btn.png
getstart_btn.png-preview.png
centerbg.png
centerbg.png-preview.png
recommendsoftinstallskin.xml
RT_ICON
ID:0001
ID:2052
ID:2052-preview.png
ID:0002
ID:2052
ID:0003
ID:2052
ID:0004
ID:2052
ID:0005
ID:2052
ID:0006
ID:2052
ID:0007
ID:2052
ID:0008
ID:2052
RT_STRING
ID:0001
ID:2052
RT_GROUP_CURSOR4
ID:0066
ID:2052
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.didat
.rsrc
.reloc
Resources
PNG
ID:0065
ID:1033
ID:1033-preview.png
ID:0066
ID:1033
ID:1033-preview.png
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:1033-preview.png
RT_DIALOG
ID:0000
ID:1033
RT_STRING
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
ID:000E
ID:1033
ID:000F
ID:1033
ID:0010
ID:1033
ID:0011
ID:1033
RT_GROUP_CURSOR4
ID:0064
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Overlay extracted: Overlay_40e95a87.bin (3867056 bytes)
Info

PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb
Artefacts
Name
 Value
PE Layout

MemoryMapped (process dump suspected)
f513a2ed8a51b4b35685410cb50102be (4.33 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙