19f88273e1076a090e4ec439c2ee560c

PE Executable

MD5: 19f88273e1076a090e4ec439c2ee560c

Size: 4.4 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

4.4 MB · 4,404,736 B

First seen

2026-09-08 02:15 · one month ago

Last seen

2026-09-08 02:15 · one month ago

Last analysis

2026-09-08 02:16 · one month ago

Hashes

MD5 19f88273e1076a090e4ec439c2ee560c Sha1 6fe767347543cf94386c17d98306ffd2798b2438 Sha256 fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6 Sha384 e05f75d89d4438818d62675dfe433b89a5b16d754ec151b10a6dc665f77a22b9116386e7c2941a8bcc5828ac10c757a2 Sha512 99fe74f4d23f122e54bf44b0f989910506215fa623baf03df9453f7e676c562b9808ba0404d73b6b78aa757d227c9ddc22cb35167511ea797f65aaf3fd83ab4a SSDeep 98304:jnsmtk2aaAD1e6OE6wDSUIEgzD/NrS27fgAf1HKcU/Y/:7LhADzOEpSUhglu27oAf5t TLSH 18161222B2D18437D1322A3C9C6BA3A5583EBE513D38764E7BE91D4C8F396423D652D3

Detection

PeID

BobSoft Mini Delphi -> BoB / BobSoftBorland Delphi 4.0Borland Delphi v3.0Borland Delphi v6.0 - v7.0Borland Delphi v6.0 - v7.0D1S1G v1.1 beta --> D1ND1S1G v1.1 beta --> D1NMicrosoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12UPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John ReiserUPX v2.0 -> Markus, Laszlo & ReiserUPolyX 0.3 -> delikon

10 malicious · 686 files

EXE19f88273e1076a090e4ec439c2ee560c

Structure

7Z7z-stream @ 0x00194E2A.7z

BINConfig

XMLconfig.xml

BINdefaultskin

ZIPdefaultskin.ui

BIN360ExaminUI

BINsec

IMGButtonL.png

IMGButtonL.png-preview.png

IMGdanger.png

IMGdanger.png-preview.png

IMGfail.png

IMGfail.png-preview.png

IMGFixAllButton.png

IMGFixAllButton.png-preview.png

IMGfixsmall.gif

IMGfixsmall.gif-preview.png

IMGhead_back.PNG

IMGhead_back.PNG-preview.png

IMGitembkgnd_hover.png

IMGitembkgnd_hover.png-preview.png

IMGmanualrepair.png

IMGmanualrepair.png-preview.png

IMGpro.PNG

IMGpro.PNG-preview.png

IMGprob.PNG

IMGprob.PNG-preview.png

IMGpromidhead.PNG

IMGpromidhead.PNG-preview.png

IMGsafeico.png

IMGsafeico.png-preview.png

IMGscanbutton.png

IMGscanbutton.png-preview.png

BINscrollh

IMGbackground.png

IMGbackground.png-preview.png

BMPbuttons.bmp

IMGbuttons.png

IMGbuttons.png-preview.png

IMGthumb.png

IMGthumb.png-preview.png

IMGthumbgripper.png

IMGthumbgripper.png-preview.png

BINscrollv

IMGbackground.png

IMGbackground.png-preview.png

BMPbuttons.bmp

IMGbuttons.png

IMGbuttons.png-preview.png

IMGthumb.png

IMGthumb.png-preview.png

IMGthumbgripper.png

IMGthumbgripper.png-preview.png

IMGSimpleButtom.png

IMGSimpleButtom.png-preview.png

IMGSkanBack_Left.png

IMGSkanBack_Left.png-preview.png

IMGSkanBack_Min.png

IMGSkanBack_Min.png-preview.png

IMGSkanBack_Right.png

IMGSkanBack_Right.png-preview.png

IMGsubitems.png

IMGsubitems.png-preview.png

IMGsuggest.png

IMGsuggest.png-preview.png

IMGUrlLine.png

IMGUrlLine.png-preview.png

IMGwarning.png

IMGwarning.png-preview.png

BIN360Unlock

IMGSplitter.jpg

IMGSplitter.jpg-preview.png

IMGunlockbkg.jpg

IMGunlockbkg.jpg-preview.png

BINAdvTools

IMGAdvanceTools_DownClose.png

IMGAdvanceTools_DownClose.png-preview.png

IMGAdvanceTools_DownClose1.png

IMGAdvanceTools_DownClose1.png-preview.png

IMGAdvanceTools_DownProgressB.jpg

IMGAdvanceTools_DownProgressB.jpg-preview.png

IMGAdvanceTools_DownProgressB1.jpg

IMGAdvanceTools_DownProgressB1.jpg-preview.png

IMGAdvanceTools_DownProgressF.png

IMGAdvanceTools_DownProgressF.png-preview.png

IMGAdvanceTools_DownProgressF1.png

IMGAdvanceTools_DownProgressF1.png-preview.png

IMGAdvanceTools_GrayStar.png

IMGAdvanceTools_GrayStar.png-preview.png

IMGAdvanceTools_titleBK.png

IMGAdvanceTools_titleBK.png-preview.png

IMGAdvanceTools_ViewClassic.png

IMGAdvanceTools_ViewClassic.png-preview.png

IMGAdvanceTools_ViewSimple.png

IMGAdvanceTools_ViewSimple.png-preview.png

IMGAdvanceTools_YellowStar.png

IMGAdvanceTools_YellowStar.png-preview.png

IMGhor_line.png

IMGhor_line.png-preview.png

IMGIconShadow.png

IMGIconShadow.png-preview.png

BINCommon

IMG360Safe-16new.png

IMG360Safe-16new.png-preview.png

IMG360Safe-16new.png1

IMG360Safe-16new.png1-preview.png

ICO360Safe.ico

IMGanimation.gif

IMGanimation.gif-preview.png

IMGbkgnd-border.png

IMGbkgnd-border.png-preview.png

IMGButtom_Hover.png

IMGButtom_Hover.png-preview.png

IMGbutton_disable.jpg

IMGbutton_disable.jpg-preview.png

IMGbutton_focus.jpg

IMGbutton_focus.jpg-preview.png

IMGbutton_normal.jpg

IMGbutton_normal.jpg-preview.png

IMGbutton_pushed.jpg

IMGbutton_pushed.jpg-preview.png

BMPcheckbox.bmp

IMGcheckbox.png

IMGcheckbox.png-preview.png

IMGclose.png

IMGclose.png-preview.png

BMPcollapse.bmp

BINCoolUI

IMGButton_Normal.png

IMGButton_Normal.png-preview.png

IMGcool_dlg_with_tab.png

IMGcool_dlg_with_tab.png-preview.png

IMGDlgBackground.png

IMGDlgBackground.png-preview.png

IMGDlgBackground_NB.png

IMGDlgBackground_NB.png-preview.png

IMGDlgBackground_simple.png

IMGDlgBackground_simple.png-preview.png

BINtab

IMGtab_background.PNG

IMGtab_background.PNG-preview.png

IMGtab_hover.PNG

IMGtab_hover.PNG-preview.png

IMGtab_normal.PNG

IMGtab_normal.PNG-preview.png

IMGtab_pushed.PNG

IMGtab_pushed.PNG-preview.png

BINTopBanner

IMGMainbanner_Danger.png

IMGMainbanner_Danger.png-preview.png

IMGMainbanner_Normal.png

IMGMainbanner_Normal.png-preview.png

IMGMainbanner_Safe.png

IMGMainbanner_Safe.png-preview.png

IMGMainbanner_Warn.png

IMGMainbanner_Warn.png-preview.png

IMGDlgBackground.jpg

IMGDlgBackground.jpg-preview.png

IMGdynamic_listbox_item_hover.png

IMGdynamic_listbox_item_hover.png-preview.png

IMGdynamic_listbox_item_normal.png

IMGdynamic_listbox_item_normal.png-preview.png

IMGdynamic_listbox_item_pushed.png

IMGdynamic_listbox_item_pushed.png-preview.png

IMGerror_back.png

IMGerror_back.png-preview.png

BMPexpand.bmp

IMGForeground.jpg

IMGForeground.jpg-preview.png

IMGframe.jpg

IMGframe.jpg-preview.png

BMPframe_border.bmp

BMPheaderctrl_hover.bmp

BMPheaderctrl_normal16.bmp

IMGlistCtrlBtn_Disable.jpg

IMGlistCtrlBtn_Disable.jpg-preview.png

IMGlistCtrlBtn_Focus.jpg

IMGlistCtrlBtn_Focus.jpg-preview.png

IMGlistCtrlBtn_Normal.jpg

IMGlistCtrlBtn_Normal.jpg-preview.png

IMGlistCtrlBtn_Pushed.jpg

IMGlistCtrlBtn_Pushed.jpg-preview.png

IMGmsg_icon_check.png

IMGmsg_icon_check.png-preview.png

IMGmsg_icon_error.png

IMGmsg_icon_error.png-preview.png

IMGmsg_icon_info.png

IMGmsg_icon_info.png-preview.png

IMGmsg_icon_question.png

IMGmsg_icon_question.png-preview.png

IMGnetstateerror2.png

IMGnetstateerror2.png-preview.png

IMGnetstateok2.png

IMGnetstateok2.png-preview.png

BINold

IMGsysmenu_close2.png

IMGsysmenu_close2.png-preview.png

IMGsys_button_close.png

IMGsys_button_close.png-preview.png

IMGsys_button_max.png

IMGsys_button_max.png-preview.png

IMGsys_button_menu.png

IMGsys_button_menu.png-preview.png

IMGsys_button_min.png

IMGsys_button_min.png-preview.png

IMGsys_button_restore.png

IMGsys_button_restore.png-preview.png

IMGsys_dlg_close.png

IMGsys_dlg_close.png-preview.png

IMGsys_dlg_max.png

IMGsys_dlg_max.png-preview.png

IMGsys_dlg_min.png

IMGsys_dlg_min.png-preview.png

IMGsys_dlg_restore.png

IMGsys_dlg_restore.png-preview.png

BMPpopup_dialog_title_bar_background.bmp

BMPprogress_ctrl_background.bmp

BMPprogress_ctrl_fg.bmp

BMPradiobutton.bmp

IMGradiobutton.png

IMGradiobutton.png-preview.png

IMGSafe_S.png

IMGSafe_S.png-preview.png

BINscrollh

IMGbackground.png

IMGbackground.png-preview.png

IMGbuttons.png

IMGbuttons.png-preview.png

IMGthumb.png

IMGthumb.png-preview.png

IMGthumbgripper.png

IMGthumbgripper.png-preview.png

BINscrollv

IMGbackground.png

IMGbackground.png-preview.png

IMGbuttons.png

IMGbuttons.png-preview.png

IMGthumb.png

IMGthumb.png-preview.png

IMGthumbgripper.png

IMGthumbgripper.png-preview.png

IMGSearchR_InfoS.png

IMGSearchR_InfoS.png-preview.png

IMGsys_button_close.png

IMGsys_button_close.png-preview.png

IMGsys_button_max.png

IMGsys_button_max.png-preview.png

IMGsys_button_min.png

IMGsys_button_min.png-preview.png

IMGsys_button_min2.png

IMGsys_button_min2.png-preview.png

IMGsys_button_restore.png

IMGsys_button_restore.png-preview.png

BMPtab_background.bmp

IMGTips.png

IMGTips.png-preview.png

IMGtips_D01.png

IMGtips_D01.png-preview.png

IMGtitle_bar_menu.png

IMGtitle_bar_menu.png-preview.png

IMGtoolbar_hover.png

IMGtoolbar_hover.png-preview.png

IMGtoolbar_normal.png

IMGtoolbar_normal.png-preview.png

IMGtoolbar_pushed.png

IMGtoolbar_pushed.png-preview.png

IMGtoolbar_sim_hover.png

IMGtoolbar_sim_hover.png-preview.png

IMGtoolbar_sim_normal.png

IMGtoolbar_sim_normal.png-preview.png

IMGtoolbar_sim_pushed.png

IMGtoolbar_sim_pushed.png-preview.png

BINFileSmasher

BMPCheckBox.bmp

BMPUnCheckBox.bmp

BINLSPFix

BMPsafe.bmp

BMPunknown.bmp

BINMainFrame

IMGAddSkin.png

IMGAddSkin.png-preview.png

IMGButton_Glass.png

IMGButton_Glass.png-preview.png

IMGcool_dlg_set.png

IMGcool_dlg_set.png-preview.png

IMGdlg_skin.png

IMGdlg_skin.png-preview.png

IMGDragbar_HBack.png

IMGDragbar_HBack.png-preview.png

IMGDragbar_HBar.png

IMGDragbar_HBar.png-preview.png

IMGframemod.png

IMGframemod.png-preview.png

IMGframemod_sim.png

IMGframemod_sim.png-preview.png

IMGhistoryitem.PNG

IMGhistoryitem.PNG-preview.png

IMGIconOK.png

IMGIconOK.png-preview.png

IMGMenu_Icon_AutoStart.png

IMGMenu_Icon_AutoStart.png-preview.png

IMGNew2.png

IMGNew2.png-preview.png

IMGSkinButtom.png

IMGSkinButtom.png-preview.png

IMGSkin_Back2.png

IMGSkin_Back2.png-preview.png

IMGSkin_Del.png

IMGSkin_Del.png-preview.png

IMGTitleBack.png

IMGTitleBack.png-preview.png

BINPluginCleaner

IMGBalloonSound.png

IMGBalloonSound.png-preview.png

IMGBanLeft.gif

IMGBanLeft.gif-preview.png

IMGBanRight.gif

IMGBanRight.gif-preview.png

BMPdanger.bmp

BMPPromptBackGround.bmp

IMGRedStar.png

IMGRedStar.png-preview.png

BMPsafe.bmp

IMGScan.gif

IMGScan.gif-preview.png

BMPsuggest.bmp

BMPtitle_background.bmp

BMPwarning.bmp

BINrealtimeprotect

IMGfirewallbk.png

IMGfirewallbk.png-preview.png

BINTracesCleaner

BMPtreectrlstate.bmp

TXTver.txt

VBSMiniUI.xml

VBSMiniUI.xml.deobfuscated.vbs

IMGSkin.jpg

IMGSkin.jpg-preview.png

BINnetmon

INI360netmon.ini

DAT360NetSpd2.dat

DAT360NetSpd3.dat

INI360Speedr.ini

HIS360SpeedTest.his

DAT360SpeedTestWebList.dat

NPLnetspeed.npl

DATnetspeedtipflag.dat

DLL360Netdr.dll

Structure

P7B[Authenticode]_ef345bd5.p7b

BINResources

BINRT_RCDATA

BINID:0360

BINID:1033

BINRT_VERSION

BINID:0001

BINID:2052

BINRT_MANIFEST

BINID:0002

BINID:1033

EXE360SpeedTest.exe

Structure

P7B[Authenticode]_bfdea8fc.p7b

BINResources

BINPNG

BINID:00C9

IMGID:2052

IMGID:2052-preview.png

BINID:00CA

IMGID:2052

IMGID:2052-preview.png

BINID:00CB

IMGID:2052

IMGID:2052-preview.png

BINID:00CC

IMGID:2052

IMGID:2052-preview.png

BINID:00CD

IMGID:2052

IMGID:2052-preview.png

BINID:00CE

IMGID:2052

IMGID:2052-preview.png

BINID:00CF

IMGID:2052

IMGID:2052-preview.png

BINID:00D0

IMGID:2052

IMGID:2052-preview.png

BINID:00D2

IMGID:2052

IMGID:2052-preview.png

BINID:00D3

IMGID:2052

IMGID:2052-preview.png

BINID:00D4

IMGID:2052

IMGID:2052-preview.png

BINID:00D5

IMGID:2052

IMGID:2052-preview.png

BINID:00D6

IMGID:2052

IMGID:2052-preview.png

BINID:00D7

IMGID:2052

IMGID:2052-preview.png

BINID:00D8

IMGID:2052

IMGID:2052-preview.png

BINID:00D9

IMGID:2052

IMGID:2052-preview.png

BINID:00DC

IMGID:2052

IMGID:2052-preview.png

BINID:00DD

IMGID:2052

IMGID:2052-preview.png

BINID:00E0

IMGID:2052

IMGID:2052-preview.png

BINID:00E1

IMGID:2052

IMGID:2052-preview.png

BINID:00E3

IMGID:2052

IMGID:2052-preview.png

BINID:00E4

IMGID:2052

IMGID:2052-preview.png

BINID:00E7

IMGID:2052

IMGID:2052-preview.png

BINID:00E9

IMGID:2052

IMGID:2052-preview.png

BINID:00EA

IMGID:2052

IMGID:2052-preview.png

BINID:00EB

IMGID:2052

IMGID:2052-preview.png

BINID:00EC

IMGID:2052

IMGID:2052-preview.png

BINID:00ED

IMGID:2052

IMGID:2052-preview.png

BINID:00EE

IMGID:2052

IMGID:2052-preview.png

BINID:00EF

IMGID:2052

IMGID:2052-preview.png

BINID:00F0

IMGID:2052

IMGID:2052-preview.png

BINID:00F1

IMGID:2052

IMGID:2052-preview.png

BINID:00F2

IMGID:2052

IMGID:2052-preview.png

BINID:00F3

IMGID:2052

IMGID:2052-preview.png

BINID:00F4

IMGID:2052

IMGID:2052-preview.png

BINID:00F5

IMGID:2052

IMGID:2052-preview.png

BINID:00F6

IMGID:2052

IMGID:2052-preview.png

BINID:00F7

IMGID:2052

IMGID:2052-preview.png

BINID:00F8

IMGID:2052

IMGID:2052-preview.png

BINID:00F9

IMGID:2052

IMGID:2052-preview.png

BINID:00FB

IMGID:2052

IMGID:2052-preview.png

BINID:00FD

IMGID:2052

IMGID:2052-preview.png

BINID:00FE

IMGID:2052

IMGID:2052-preview.png

BINID:00FF

IMGID:2052

IMGID:2052-preview.png

BINID:0100

IMGID:2052

IMGID:2052-preview.png

BINID:0101

IMGID:2052

IMGID:2052-preview.png

BINID:0102

IMGID:2052

IMGID:2052-preview.png

BINID:0103

IMGID:2052

IMGID:2052-preview.png

BINID:0104

IMGID:2052

IMGID:2052-preview.png

BINID:0105

IMGID:2052

IMGID:2052-preview.png

BINID:0106

IMGID:2052

IMGID:2052-preview.png

BINID:0107

IMGID:2052

IMGID:2052-preview.png

BINID:0108

IMGID:2052

IMGID:2052-preview.png

BINID:0109

IMGID:2052

IMGID:2052-preview.png

BINID:010A

IMGID:2052

IMGID:2052-preview.png

BINID:010B

IMGID:2052

IMGID:2052-preview.png

BINID:010C

IMGID:2052

IMGID:2052-preview.png

BINID:010D

IMGID:2052

IMGID:2052-preview.png

BINID:010E

IMGID:2052

IMGID:2052-preview.png

BINID:0110

IMGID:2052

IMGID:2052-preview.png

BINID:0112

IMGID:2052

IMGID:2052-preview.png

BINID:0113

IMGID:2052

IMGID:2052-preview.png

BINID:0114

IMGID:2052

IMGID:2052-preview.png

BINID:0115

IMGID:2052

IMGID:2052-preview.png

BINID:0116

IMGID:2052

IMGID:2052-preview.png

BINID:03FB

IMGID:2052

IMGID:2052-preview.png

BINID:03FC

IMGID:2052

IMGID:2052-preview.png

BINID:03FD

IMGID:2052

IMGID:2052-preview.png

BINID:03FE

IMGID:2052

IMGID:2052-preview.png

BINID:03FF

IMGID:2052

IMGID:2052-preview.png

BINID:0401

IMGID:2052

IMGID:2052-preview.png

BINRT_DIALOG

BINID:0064

BINID:2052

BINID:0081

BINID:2052

BINID:00DE

BINID:2052

BINID:010F

BINID:2052

BINID:0111

BINID:2052

BINRT_RCDATA

BINID:0360

BINID:1033

BINRT_GROUP_CURSOR4

BINID:0080

BINID:2052

BINRT_VERSION

BINID:0001

BINID:2052

BINRT_MANIFEST

BINID:0001

BINID:1033

BINRT_DLGINIT

BINID:0081

BINID:2052

DLLNetSpeed.dll

Structure

P7B[Authenticode]_7a30d448.p7b

BINResources

BINRT_RCDATA

BINID:0360

BINID:1033

BINRT_VERSION

BINID:0001

BINID:2052

DLL360Base.dll

Structure

P7B[Authenticode]_5fcd132c.p7b

BINResources

BINRT_RCDATA

BINID:0360

BINID:1033

BINRT_VERSION

BINID:0001

BINID:2052

BINRT_MANIFEST

BINID:0002

BINID:1033

DLL360Conf.dll

Structure

P7B[Authenticode]_d379f881.p7b

BINResources

BINRT_RCDATA

BINID:0360

BINID:1033

BINRT_VERSION

BINID:0001

BINID:2052

DLL360net.dll

Structure

P7B[Authenticode]_927d6b70.p7b

BINResources

BINRT_DIALOG

BINID:0066

BINID:1033

BINID:2052

BINRT_RCDATA

BINID:0360

BINID:1033

BINRT_VERSION

BINID:0001

BINID:1033

BINID:2052

DLL360NetBase.dll

Structure

P7B[Authenticode]_f59e6aa3.p7b

BINResources

BINRT_RCDATA

BINID:0360

BINID:1033

BINID:2052

BINRT_VERSION

BINID:0001

BINID:2052

BINRT_MANIFEST

BINID:0002

BINID:1033

DLL360NetUL.dll

Structure

P7B[Authenticode]_287ac9a5.p7b

BINResources

BINRT_DIALOG

BINID:03E9

BINID:2052

BINRT_RCDATA

BINID:0360

BINID:1033

BINRT_VERSION

BINID:0001

BINID:2052

DLL360P2SP.dll

Structure

P7B[Authenticode]_eaa70b02.p7b

BINResources

BINRT_DIALOG

BINID:0065

BINID:1033

BINID:2052

BINRT_RCDATA

BINID:0360

BINID:1033

BINRT_VERSION

BINID:0001

BINID:1033

BINID:2052

DLL360Util.dll

Structure

P7B[Authenticode]_8ff4af42.p7b

BINResources

BINRT_RCDATA

BINID:0360

BINID:1033

BINRT_VERSION

BINID:0001

BINID:2052

DLL360Verify.dll

Structure

P7B[Authenticode]_052b70a9.p7b

BINResources

BINRT_RCDATA

BINID:0360

BINID:1033

BINRT_VERSION

BINID:0001

BINID:2052

DLLCrashReport.dll

Structure

P7B[Authenticode]_d97b836c.p7b

BINResources

BINRT_CURSOR

BINID:0001

BINID:2052

BINID:0002

BINID:2052

BINID:0003

BINID:2052

BINID:0004

BINID:2052

BINID:0005

BINID:2052

BINID:0006

BINID:2052

BINID:0007

BINID:2052

BINID:0008

BINID:2052

BINID:0009

BINID:2052

BINID:000A

BINID:2052

BINID:000B

BINID:2052

BINID:000C

BINID:2052

BINID:000D

BINID:2052

BINID:000E

BINID:2052

BINID:000F

BINID:2052

BINID:0010

BINID:2052

BINRT_BITMAP

BINID:7912

BINID:2052

BINID:7914

BINID:2052

BINRT_DIALOG

BINID:7801

BINID:2052

BINID:780E

BINID:2052

BINRT_STRING

BINID:0F01

BINID:2052

BINID:0F02

BINID:2052

BINID:0F03

BINID:2052

BINID:0F11

BINID:2052

BINID:0F12

BINID:2052

BINID:0F13

BINID:2052

BINID:0F14

BINID:2052

BINID:0F19

BINID:2052

BINID:0F1A

BINID:2052

BINID:0F1B

BINID:2052

BINID:0F1C

BINID:2052

BINID:0F1D

BINID:2052

BINID:0F2F

BINID:2052

BINRT_RCDATA

BINID:0360

BINID:1033

BINRT_GROUP_CURSOR2

BINID:7901

BINID:2052

BINID:7916

BINID:2052

BINID:791A

BINID:2052

BINID:791C

BINID:2052

BINID:791E

BINID:2052

BINID:791F

BINID:2052

BINID:7920

BINID:2052

BINID:7921

BINID:2052

BINID:7922

BINID:2052

BINID:7923

BINID:2052

BINRT_VERSION

BINID:0001

BINID:2052

BINipc

DLLipcservice.dll

Structure

P7B[Authenticode]_5b254fdf.p7b

BINResources

BINRT_STRING

BINID:0007

BINID:2052

BINRT_RCDATA

BINID:0360

BINID:1033

BINRT_VERSION

BINID:0001

BINID:2052

DLLLiveUpd360.dll

Structure

P7B[Authenticode]_5670ce05.p7b

BINResources

BINRT_RCDATA

BINID:0360

BINID:1033

BINRT_VERSION

BINID:0001

BINID:1033

BINID:2052

DLLPDown.dll

Structure

P7B[Authenticode]_9eaa960a.p7b

BINResources

BINRT_RCDATA

BINID:0000

BINID:1033

BINID:0360

BINID:1033

BINRT_VERSION

BINID:0001

BINID:2052

BINsafemon

DLLurlproc.dll

Structure

P7B[Authenticode]_c71da029.p7b

BINResources

BINRT_STRING

BINID:0007

BINID:2052

BINRT_RCDATA

BINID:0360

BINID:1033

BINRT_VERSION

BINID:0001

BINID:2052

BINRT_MANIFEST

BINID:0002

BINID:1033

BINResources

BINRT_CURSOR

BINID:0001

BINID:0

BINID:0002

BINID:0

BINID:0003

BINID:0

BINID:0004

BINID:0

BINID:0005

BINID:0

BINID:0006

BINID:0

BINID:0007

BINID:0

BINRT_BITMAP

BINID:0000

BINID:0

BINRT_ICON

BINID:0001

BINID:0

BINID:1055

BINRT_DIALOG

BINID:0000

BINID:0

BINRT_STRING

BINID:0FE9

BINID:0

BINID:0FEA

BINID:0

BINID:0FEB

BINID:0

BINID:0FEC

BINID:0

BINID:0FED

BINID:0

BINID:0FEE

BINID:0

BINID:0FEF

BINID:0

BINID:0FF0

BINID:0

BINID:0FF1

BINID:0

BINID:0FF2

BINID:0

BINID:0FF3

BINID:0

BINID:0FF4

BINID:0

BINID:0FF5

BINID:0

BINID:0FF6

BINID:0

BINID:0FF7

BINID:0

BINID:0FF8

BINID:0

BINID:0FF9

BINID:0

BINID:0FFA

BINID:0

BINID:0FFB

BINID:0

BINID:0FFC

BINID:0

BINID:0FFD

BINID:0

BINID:0FFE

BINID:0

BINID:0FFF

BINID:0

BINID:1000

BINID:0

BINRT_RCDATA

BINID:0000

BINID:0

Structure

7Z7z-stream @ 0x000E1816.7z

7ZOverlay_444728b1.bin

BINResources

BINSCRIPT

BINID:0065

BINID:2052

BINID:0067

BINID:2052

BINRT_ICON

BINID:0032

BINID:0

BINID:0033

BINID:0

BINID:0034

BINID:0

BINRT_DIALOG

BINID:271B

BINID:2052

BINID:271C

BINID:2052

BINID:271D

BINID:2052

BINID:271E

BINID:2052

BINID:2720

BINID:2052

BINID:2723

BINID:2052

BINRT_GROUP_CURSOR4

BINID:0001

BINID:0

BINRT_VERSION

BINID:0001

BINID:2052

BINRT_MANIFEST

BINID:0001

BINID:2052

XLSID:1055

Structure

BINResources

BINRT_RCDATA

BINID:0000

BINID:0

XML[Content_Types].xml

BIN_rels

XML.rels

BINxl

BIN_rels

XMLworkbook.xml.rels

XMLworkbook.xml

OFFvbaProject.bin

BINRoot Entry

BINPROJECT

BINPROJECTwm

BINVBA

BINdir

BIN__SRP_0

BIN__SRP_1

BIN__SRP_2

BIN__SRP_3

VBAThisWorkbook

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

BIN_VBA_PROJECT

BINtheme

XMLtheme1.xml

XMLstyles.xml

BINworksheets

XMLsheet1.xml

BINdocProps

XMLcore.xml

XMLapp.xml

BINRT_GROUP_CURSOR2

BINID:7FF9

BINID:0

BINID:7FFA

BINID:0

BINID:7FFB

BINID:0

BINID:7FFC

BINID:0

BINID:7FFD

BINID:0

BINID:7FFE

BINID:0

BINID:7FFF

BINID:0

BINRT_GROUP_CURSOR4

BINID:0000

BINID:1055

BINRT_VERSION

BINID:0001

BINID:1055

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 24 STICH kept: 12secondary ignored: 12

bin 9img 3

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

12 / 12

Path pe:exe>pe:rsrc>oox:xlsm~T1027~T1059.005~T1112>oox:vba~T1027~T1059.005~T1112

Shape pe:exe>pe:rsrc>oox:xlsm>oox:vba

malicious 4 nodes

Path pe:exe>pe:rsrc>oox:xlsm~T1027~T1059.005~T1112>oox:vba~T1059.005

Shape pe:exe>pe:rsrc>oox:xlsm>oox:vba

malicious 4 nodes

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

10 malicious · 686 files

EXE19f88273e1076a090e4ec439c2ee560c

Structure

7Z7z-stream @ 0x00194E2A.7z

BINConfig

XMLconfig.xml

BINdefaultskin

ZIPdefaultskin.ui

VBSMiniUI.xml

VBSMiniUI.xml.deobfuscated.vbs

IMGSkin.jpg

BINnetmon

DLL360Base.dll

DLL360Conf.dll

DLL360net.dll

DLL360NetBase.dll

DLL360NetUL.dll

DLL360P2SP.dll

DLL360Util.dll

DLL360Verify.dll

DLLCrashReport.dll

BINipc

DLLLiveUpd360.dll

DLLPDown.dll

BINsafemon

BINResources

BINRT_CURSOR

BINRT_BITMAP

BINRT_ICON

BINRT_DIALOG

BINRT_STRING

BINRT_RCDATA

BINID:0000

BINID:0

XLSID:1055

Structure

BINResources

XML[Content_Types].xml

BIN_rels

BINxl

BIN_rels

XMLworkbook.xml

OFFvbaProject.bin

BINRoot Entry

BINPROJECT

BINPROJECTwm

BINVBA

BINdir

BIN__SRP_0

BIN__SRP_1

BIN__SRP_2

BIN__SRP_3

VBAThisWorkbook

VBS[Stored VBA]

VBS[Stored VBA].deobfuscated.vbs

VBA[PCode]

VBS[Decompiled VBA]

VBS[Decompiled VBA].deobfuscated.vbs

BIN_VBA_PROJECT

BINtheme

XMLstyles.xml

BINworksheets

BINdocProps

BINRT_GROUP_CURSOR2

BINRT_GROUP_CURSOR4

BINRT_VERSION

vbaDNA - VBA Stomping & Purging Stategy detection

	Module Name0
	ThisWorkbook	Blacklist VBA VBA Macro
PCode Decompiled VBA Stored VBA Partial Diff. Full Diff. Missing P-Code: The Office document under analysis has been identified as having undergone VBA Purging techniques, as the P-Code block within the document is currently inaccessible. As a result, the decompilation of the code was not possible, leaving only the stored code available in textual format for analysis. VBA Purging essentially involves the elimination of the PerformanceCache section from the module streams. To fully erase any traces of the P-Code section, the MODULEOFFSET between the two sections is adjusted to 0 by altering the _VBA_PROJECT stream, and all SRP streams that also house PerformanceCache data are removed. Following the removal of the compiled code, antivirus engines and Yara rules, which depend on precise string matches, are rendered ineffective. This allows macros to bypass them effortlessly, owing to the compressed format of the remaining source code.

No malware configuration was found at this point.

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

19f88273e1076a090e4ec439c2ee560c › Resources › RT_RCDATA › ID:0000 › ID:1055 › xl › vbaProject.bin › Root Entry › VBA › ThisWorkbook › [Stored VBA]

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

19f88273e1076a090e4ec439c2ee560c › Resources › RT_RCDATA › ID:0000 › ID:1055 › xl › vbaProject.bin › Root Entry › VBA › ThisWorkbook › [Stored VBA]

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

19f88273e1076a090e4ec439c2ee560c › Resources › RT_RCDATA › ID:0000 › ID:1055 › xl › vbaProject.bin › Root Entry › VBA › ThisWorkbook › [Stored VBA]

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

19f88273e1076a090e4ec439c2ee560c › Resources › RT_RCDATA › ID:0000 › ID:1055 › xl › vbaProject.bin › Root Entry › VBA › ThisWorkbook › [Decompiled VBA]

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential