Malwarebytes Premium 5.1.1.106 Multilingual.zip
- SHA256 e37343284c9535ff78ac7420400b63792161d111d21f7d86761facd922e8037c
Password
infected
Overview
overview
10Static
static
3Malwarebyt...al.zip
windows10-2004-x64
1Malwarebyt...al.zip
windows11-ltsc_2024-x64
1Malwarebyt...up.exe
windows10-2004-x64
10Malwarebyt...up.exe
windows11-ltsc_2024-x64
8Malwarebyt...tch.7z
windows10-2004-x64
8Malwarebyt...tch.7z
windows11-ltsc_2024-x64
8Patch_MB_5.x.exe
windows10-2004-x64
8Patch_MB_5.x.exe
windows11-ltsc_2024-x64
8Malwarebyt....x.exe
windows10-2004-x64
8Malwarebyt....x.exe
windows11-ltsc_2024-x64
8Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Malwarebytes Premium 5.1.1.106 Multilingual.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Malwarebytes Premium 5.1.1.106 Multilingual.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Malwarebytes Premium 5.1.1.106 Multilingual/MBSetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
43 signatures
150 seconds
Behavioral task
behavioral4
Sample
Malwarebytes Premium 5.1.1.106 Multilingual/MBSetup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
Malwarebytes Premium 5.1.1.106 Multilingual/Patch.7z
Resource
win10v2004-20260513-en
windows10-2004-x64
38 signatures
150 seconds
Behavioral task
behavioral6
Sample
Malwarebytes Premium 5.1.1.106 Multilingual/Patch.7z
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral7
Sample
Patch_MB_5.x.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
37 signatures
150 seconds
Behavioral task
behavioral8
Sample
Patch_MB_5.x.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
38 signatures
150 seconds
Behavioral task
behavioral9
Sample
Malwarebytes Premium 5.1.1.106 Multilingual/Patch/Patch_MB_5.x.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
37 signatures
150 seconds
Behavioral task
behavioral10
Sample
Malwarebytes Premium 5.1.1.106 Multilingual/Patch/Patch_MB_5.x.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
37 signatures
150 seconds
General
- Target Malwarebytes Premium 5.1.1.106 Multilingual.zip
- Size 410.1MB
- Sample260905-ymmcdaytb1
- SHA256 e37343284c9535ff78ac7420400b63792161d111d21f7d86761facd922e8037c
- MD5 7977da124fd86d3b64c2cf7eb8fb5778
- SHA1 526123de4a60076fcbbaf06af70d9b94be37c6e2
- SHA512 8aaea68902a03a48e83cc0587cd220a37a7bd5f7d56522d2813f5c016a90423cc4147302a34fceef187dd8346c0c6ee86f18844b0dffea645069ea40c1e6a653
- SSDEEP 12582912:q8eUfLP4a+XG10Bc227oBnylgc+vti7K9NAUUA7C2:q8eO+XG17snylQvIeHAx2
- TLSH T1A829337DEB490CF401AC8D7988EE51F7ACDE2D4212A865483B67B4E2761C0DBD0A357B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack003/Patch_MB_5.x.exe unpack001/Malwarebytes Premium 5.1.1.106 Multilingual/Patch/Patch_MB_5.x.exe
File Explorer
-
Malwarebytes Premium 5.1.1.106 Multilingual.zip.zip 410.1MB
-
Malwarebytes Premium 5.1.1.106 Multilingual/MBSetup.exe.exe 290.1MB
-
Malwarebytes Premium 5.1.1.106 Multilingual/Patch.7z.7z 64.9MB
-
Patch_MB_5.x.exe.exe 65.3MB
-
Malwarebytes Premium 5.1.1.106 Multilingual/Patch/Patch_MB_5.x.exe.exe 65.3MB
-
Malwarebytes Premium 5.1.1.106 Multilingual/readme.txt1KB
Malwarebytes Premium 5.1.1.106 Multilingual/MBSetup.exe
- IMPHASH 6f6c9b70a25733492952692f7a20e0a9
- SHA256 e3168b1cbdc4709dae53d4dee1c45aa7916cdf12998d84bc7b275d5d28832ba1
- MD5 8f98e1ad523e10c72f04a787bf2df6f0
- SHA1 e2d0b2c6b2609b9cfb7eaac6d35b5c0b6c627db4
- SHA512 140be3b084e2e6dccaf60b144605fd025fc59b5549df0752934715f8fc043aaf345a03eda1a511682390e4208e583e5dbead8cf527310a02350438626bb76d21
- SSDEEP 6291456:4m9f3dcwLz3zPG3hqdud7epJXN20DnMf3dc82JxqCtIIO0AE5:9xtciDrG3Uc67XNZDnEtc82JxRRtA+
- TLSH T1BEE83312B3A641B4E4B281348A6E9757C6B97C174B7186CF13807A3D1F337E59E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
27:01:57:1c:37:e0:6e:c3:2b:5c:bd:07:c1:df:1f:90:56:96:a3:1b:b3:62:1b:ca:4b:aa:df:7e:e7:ab:f2:4d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US
Chains
Mar 21, 2024
CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US
CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Digest
27:01:57:1c:37:e0:6e:c3:2b:5c:bd:07:c1:df:1f:90:56:96:a3:1b:b3:62:1b:ca:4b:aa:df:7e:e7:ab:f2:4d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US
Chains
Mar 21, 2024
CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US
Serial Number
a6:57:f7:78:b3:1a:e5:23:d6:67:13:17:18:d1:6e:b2
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 16, 2025
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 1, 2010 - Jan 18, 2038
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 3, 2023 - Aug 2, 2034
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US
Serial Number
33:00:00:d6:c7:84:67:94:85:48:b0:cd:17:00:00:00:00:d6:c7
Issuer
CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 21, 2024 - Mar 24, 2024
Subject
CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 13, 2021 - Apr 13, 2026
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 1, 2021 - Apr 1, 2036
Minor OS version
0
Major OS version
6
Entry point
452776
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Jenkins\workspace\MBAM-Windows\A_MB5_MBSetup\bin\Win32\Offline Release\MBSetup.pdb
kernel32
LeaveCriticalSection
RaiseException
EnterCriticalSection
GetLastError
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
InitializeCriticalSectionEx
DeleteCriticalSection
IsWow64Process
GetCurrentProcess
VerifyVersionInfoW
VerSetConditionMask
GetSystemDirectoryW
CreateFileW
DeviceIoControl
CloseHandle
GetCurrentThreadId
SetLastError
DeleteFileW
Sleep
GlobalFree
LockResource
FindResourceExW
LocalFree
FormatMessageW
LocalAlloc
CallNamedPipeW
GetWindowsDirectoryW
SetCurrentDirectoryW
GetCommandLineW
lstrcmpiW
CreateMutexW
GetNativeSystemInfo
GetDiskFreeSpaceExW
FindFirstFileW
FindClose
CreateProcessW
FindNextFileW
WideCharToMultiByte
GlobalAlloc
GlobalLock
SetThreadUILanguage
LoadLibraryW
CreateDirectoryW
GetLogicalDrives
GetTempPathW
MoveFileExW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
OpenProcess
ResumeThread
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32GetModuleFileNameExW
GetCurrentDirectoryW
GetCurrentProcessId
GetModuleFileNameA
OutputDebugStringW
SetEndOfFile
WriteConsoleW
SetStdHandle
GetProcAddress
GetModuleHandleW
FreeLibrary
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
DecodePointer
MulDiv
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
GetStringTypeW
FindFirstFileExW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
RemoveDirectoryW
AreFileApisANSI
CopyFileW
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
QueryPerformanceCounter
TryEnterCriticalSection
EncodePointer
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
GetVersionExW
ReleaseSemaphore
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitProcess
GetModuleHandleExW
GetCommandLineA
ExitThread
GetStdHandle
WriteFile
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
GetFileSizeEx
GetDateFormatW
dwmapi
DwmGetWindowAttribute
crypt32
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
rpcrt4
UuidToStringW
RpcStringFreeW
UuidCreate
Name
.text
Size
731KB
Virtual Size
730KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
180KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
286.6MB
Virtual Size
286.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=259, version=26213,
count=186, id=261, version=26213,
count=23, id=259, version=26706,
count=37, id=260, version=26706,
count=141, id=261, version=26706,
count=28, id=260, version=26213,
count=2, id=262, version=26213,
count=13, id=257, version=26213,
count=449, id=1, productName=Unmarked objects,
count=35, id=265, version=27049,
count=1, id=255, version=27049,
count=2, id=151,
count=1, id=258, version=27049,
Malwarebytes Premium 5.1.1.106 Multilingual/Patch.7z
- SHA256 f508e71dc1220d13dc5bf1bce5fbb08ca069ede160a2c0a79401c06046c0afd0
- MD5 b8dbd31814a82e25be0d836c33115c6c
- SHA1 bbf1feb01e824353f213ea5f2f158e323edad395
- SHA512 948ca052c1b35d62cb8532713326b3885d00e447e155266db697f3be85bef9589465ed4e166afacfa8fd28d010ba67f95a86028f2806dea1f51b0703fe580441
- SSDEEP 1572864:5Qkf2OjQHEVNdd8HaKYy1vDfezliDu1ki7bW6IO9Tb2Df:6kuqmWNfoazyRfoVbJIOx+f
- TLSH T1F5E73360CA1E3B9EF5FBA8570A085F4C782ECBEBD734C7E84D18B7101A636635A17245
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Patch_MB_5.x.exe
- IMPHASH 81530254b85f34245257b4cb8cfcd6a1
- SHA256 bd526968893102942c27d3c6c89cd92e066268bde0bc83a5569be090227d5257
- MD5 720d4425c920dd3e6d1928b0946c1765
- SHA1 f9b8f46f392c3cb11458ecee23270aa8a8479efa
- SHA512 29fa37f30199226f0bb8bc9f33e8f0dfa1b854b5fb51e19acc1c72ae7919c31976c50c4436c9ff610431e96b3668ff06c5b9366514ddb4186ff6e3f9997db39c
- SSDEEP 1572864:mKoOTa0qcP0gR8xcbkcAeuQAPLV3kZKPMwJaFMMOWQllS:1oAdTMgGibJAGAjZJ4MMGnS
- TLSH T1AFE73322D33A6BBDD1A6C03A05458F0CAB3FBABD4333C2E70441A714DB566D25F3665A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
2
Major OS version
5
Entry point
381344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
user32
MessageBoxA
CharNextW
LoadStringW
OemToCharW
MessageBoxW
LoadStringW
GetSystemMetrics
CharUpperW
CharLowerBuffW
kernel32
Sleep
VirtualFree
VirtualAlloc
HeapFree
HeapAlloc
GetProcessHeap
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwindEx
RtlUnwind
RaiseException
ExitProcess
SwitchToThread
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
LocalFree
LocalAlloc
GetModuleHandleW
FreeLibrary
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQueryEx
VirtualQuery
VirtualFree
UnmapViewOfFile
SwitchToThread
SizeofResource
SetLastError
SetFileTime
SetFilePointer
SetEvent
SetEnvironmentVariableW
SetEndOfFile
ResetEvent
RemoveDirectoryW
ReadFile
MapViewOfFile
LockResource
LocalFree
LocalFileTimeToFileTime
LoadResource
LeaveCriticalSection
IsValidLocale
InitializeCriticalSection
GetVersionExW
GetTickCount
GetThreadLocale
GetTempPathW
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeProcess
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetCommandLineW
GetCPInfo
FreeResource
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
EnterCriticalSection
DosDateTimeToFileTime
DeleteFileW
DeleteCriticalSection
CreateProcessW
CreateFileMappingW
CreateFileW
CreateEventW
CreateDirectoryW
CompareStringW
CloseHandle
Sleep
shfolder
SHGetFolderPathW
msvcrt
memcpy
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
371KB
Virtual Size
370KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
37KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
512B
Virtual Size
396B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
150B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
416B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Malwarebytes Premium 5.1.1.106 Multilingual/Patch/Patch_MB_5.x.exe
- IMPHASH 81530254b85f34245257b4cb8cfcd6a1
- SHA256 bd526968893102942c27d3c6c89cd92e066268bde0bc83a5569be090227d5257
- MD5 720d4425c920dd3e6d1928b0946c1765
- SHA1 f9b8f46f392c3cb11458ecee23270aa8a8479efa
- SHA512 29fa37f30199226f0bb8bc9f33e8f0dfa1b854b5fb51e19acc1c72ae7919c31976c50c4436c9ff610431e96b3668ff06c5b9366514ddb4186ff6e3f9997db39c
- SSDEEP 1572864:mKoOTa0qcP0gR8xcbkcAeuQAPLV3kZKPMwJaFMMOWQllS:1oAdTMgGibJAGAjZJ4MMGnS
- TLSH T1AFE73322D33A6BBDD1A6C03A05458F0CAB3FBABD4333C2E70441A714DB566D25F3665A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
2
Major OS version
5
Entry point
381344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
user32
MessageBoxA
CharNextW
LoadStringW
OemToCharW
MessageBoxW
LoadStringW
GetSystemMetrics
CharUpperW
CharLowerBuffW
kernel32
Sleep
VirtualFree
VirtualAlloc
HeapFree
HeapAlloc
GetProcessHeap
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwindEx
RtlUnwind
RaiseException
ExitProcess
SwitchToThread
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
LocalFree
LocalAlloc
GetModuleHandleW
FreeLibrary
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQueryEx
VirtualQuery
VirtualFree
UnmapViewOfFile
SwitchToThread
SizeofResource
SetLastError
SetFileTime
SetFilePointer
SetEvent
SetEnvironmentVariableW
SetEndOfFile
ResetEvent
RemoveDirectoryW
ReadFile
MapViewOfFile
LockResource
LocalFree
LocalFileTimeToFileTime
LoadResource
LeaveCriticalSection
IsValidLocale
InitializeCriticalSection
GetVersionExW
GetTickCount
GetThreadLocale
GetTempPathW
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeProcess
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetCommandLineW
GetCPInfo
FreeResource
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
EnterCriticalSection
DosDateTimeToFileTime
DeleteFileW
DeleteCriticalSection
CreateProcessW
CreateFileMappingW
CreateFileW
CreateEventW
CreateDirectoryW
CompareStringW
CloseHandle
Sleep
shfolder
SHGetFolderPathW
msvcrt
memcpy
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
371KB
Virtual Size
370KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
37KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
512B
Virtual Size
396B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
150B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
416B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Malwarebytes Premium 5.1.1.106 Multilingual/readme.txt
- SHA256 ac15d6436641a0358cb1f4b7c4fec078b2897e6963f6198f12365b1d7b25adab
- MD5 c83dc12f0333ba8a6f2b36544e4412da
- SHA1 63c6955f16a08f37150a1857ad8252b301848af6
- SHA512 82a4033e5428673bfb54b250ca2510d5ec86338fb870891466bad576b6885e750a40137d1f3cf1f56a408450287ab0ae75cf5d230fd361e72069bff77b769c2e
- TLSH T12F111F3A3E5A0370EF7252957ADED1CEBF09C09C023D552234EA8818039742A6A9D5E9
- MD5 SHA1 SHA512 TLSH