475370

Authenticode chain CN: Plugin Setup Build Number F5443 (32-bit)PE leaf certificate self-issued metadata
SHA-25620054cb852a02a0a0704efa90ab2ee619377202a00fb79c505b51616a130fe56

Evidence

VB6 runtime DLL string 0x228–0x258
0x228c31fb049100000000000000000000000...I............
0x2384d535642564d36302e444c4c00000000MSVBVM60.DLL....
0x24800000000000000000000000000000000................
0x258000000000000000000000000 ............
VB6 DllFunctionCall thunk 0x1058–0x10b8
0x105834780e66ee940f66b97d0e66ea620f664x.f...f.}.f.b.f
0x1068749b0c66f6971066aec60d66fda00066t..f...f...f...f
0x10787a660f66f6090f66258b1066879b0c66zf.f...f%..f...f
0x108893950f66859a0c66df470e66db7d0f66...f...f.G.f.}.f
0x10981dbf0c6689060f66ba030f664d7f0e66...f...f...fM..f
0x10a8560f0e66137510668d730e662b940f66V..f.u.f.s.f+..f
0x10b85f530d6667e80c6637a20d663a _S.fg..f7..f:
.dll extension reference 0x2491–0x24c1
0x2491ffd0ffe00000000a0000006764693332...........gdi32
0x24a12e646c6c0000000b000000456e756d46.dll.......EnumF
0x24b16f6e74734100009c244000ac24400000ontsA...$@..$@..
0x24c100040094 ....
PE version resource structure 0x90186–0x901b6
0x901860000b0040000000000000c0234000000............4...
0x90196560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x901a64f004e005f0049004e0046004f000000O.N._.I.N.F.O...
0x901b60000bd04effe000001000800040000 ...............
PE FileVersion metadata field 0x90262–0x903a2
⋯6 more rows
0x902c261006d006500000000006f0075006100a.m.e.....o.u.a.
0x902d26200650000002c000a00010046006900b.e...,.....F.i.
0x902e26c006500560065007200730069006f00l.e.V.e.r.s.i.o.
0x902f26e000000000034002e00300038000000n.....4...0.8...
0x90302000030000a000100500072006f006400..0.....P.r.o.d.
0x9031275006300740056006500720073006900u.c.t.V.e.r.s.i.
0x903226f006e00000034002e00300038000000o.n...4...0.8...
⋯4 more rows
0x9037261006c00460069006c0065006e006100a.l.F.i.l.e.n.a.
0x903826d006500000041004900520041002e00m.e...A.I.R.A...
0x9039265007800650000000000000001000300e.x.e...........
0x903a24040000001000800281600003175 @@......(...1u

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.