MDE_File_Sample_8f41a4054f8c4f3263ab10aadc7864190702d9eb[.]zip

General

Target

MDE_File_Sample_8f41a4054f8c4f3263ab10aadc7864190702d9eb.zip
Size

58KB
MD5

920cecb4d195112594d7426713c8c366
SHA1

c6c833dc4c1a82e6a78a2a882bcce8411eae6950
SHA256

938049cbd576530421480f7d486647896c0574c47cae0c8528408f5e7be1a61d
SHA512

1f9a30c96fb8f9b48f517e13c5b73ea5f9a35e95a73c8657adace2a1560854a272c6fd4070e282353c5a00181ed3697a950c8c511786a2e3634e652752ab444b
SSDEEP

1536:hdRuxxj6T2hTPHrUVJqqbvilZ7OJYGla72Sb:hdRojj5P/Qv9Adb

Score

1^/10

MDE_File_Sample_8f41a4054f8c4f3263ab10aadc7864190702d9eb.zip
.zip

Password: infected
Defender detected and quarantined 'HackTool:Win32/Keygen' in file 'nitropro_117157.rar->nitropdf.enterprise.pro.11.xx-Upd1.patch.rar->nitropdf.enterprise.pro.x64.11.xx-Upd1.patch.exe' during an on-demand scan
.exe windows x86

dc73a9bd8de0fd640549c85ac4089b87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile

Sections

.text
Size: 512B - Virtual size: 502B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ