Suspicious
Suspect

fa5b9ea9f85fe1980f0f5063ce44cc0a

Share on LinkedIn
Print
PE Executable
MD5: fa5b9ea9f85fe1980f0f5063ce44cc0a
Size: 16.71 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 fa5b9ea9f85fe1980f0f5063ce44cc0a
Sha1 d4b46417437b7be247b60df6c6804cbfe179ac21
Sha256 8dcda89abe8d1192c60f5e2ce46af13ff4a73411eb2ad1311ff80fd54541c20b
Sha384 35e31fbfbf82a3c3b5980adb8148c71f4c97b002f3825869944083619956d25d2e50a302849f424e94c432dbcf6da56c
Sha512 3eec61af826005af8ad56ebc5a6a033873d9fb6851702efe84c33500735985d41230fdda833d557a418e7dafe05f122d40f165022bcd4fd2a287e13a28e01eeb
SSDeep 393216:3Gyl/dRToAPS2wRg1CKID+EFXXhEMXZfD9KEhxyrltKUeZOxc:2yl/DSf8CXD+4HXXZ4EhkZtKUeoe
TLSH E3F63308EFD470B6FD639231CEB786D4DA39BC06076096EB17A0945B1DB72D1CA36722
OpenLink.ps1
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.reloc
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
IBar2Double&&
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ILRepack.List
ILRepack.List
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.didat
.fptable
.rsrc
.reloc
Resources
PNG
ID:0065
ID:1033
ID:1033-preview.png
ID:0066
ID:1033
ID:1033-preview.png
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:1033-preview.png
RT_DIALOG
ID:0000
ID:1033
RT_STRING
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
ID:000E
ID:1033
ID:000F
ID:1033
ID:0010
ID:1033
ID:0011
ID:1033
RT_GROUP_CURSOR4
ID:0064
ID:1033
RT_MANIFEST
ID:0001
ID:1033
STICH beta

No STICH Path has been generated for this analysis yet.

9 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 8img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_041cc747.bin (16227324 bytes)
Info
PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb
An error has occurred. This application may no longer respond until reloaded. Reload 🗙