Malicious
Malicious
Infection Chain
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
226544c9dc557106300e4bcd139fa882
Sha1
abe5d43e33e395a360b8a990af25531853ef1d58
Sha256
fedbb28a14b790204f071ee1f3561d48943e8f7cd638f83128ab351968f508f6
Sha384
1f6b3301f6dc8e4ba5a2e4bf99266736fd0b218aac4f4089a611952bf62d72ea9f9b740992129d210df7418b6dba243a
Sha512
5e983637ca6fab9de68861da5705b35538f80bae457af138fe4e53ac30e067cfe47e1c11ec9152bcc1a7c44cbb577495240003558020f17b11f1fcea3ed7fc39
SSDeep
12288:wMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9dVSmt0LD5gR:wnsJ39LyjbJkQFMhmC+6GD9/ES
TLSH
12157D32F6E1D437D2771E3C5D5BA3A4482ABE512F24358BB7F81E8C4E392C12965293

PeID

BobSoft Mini Delphi -> BoB / BobSoft
Borland Delphi 4.0
Borland Delphi v3.0
Borland Delphi v6.0 - v7.0
Borland Delphi v6.0 - v7.0
D1S1G v1.1 beta --> D1N
D1S1G v1.1 beta --> D1N
Microsoft Visual C++ v6.0 DLL
Pe123 v2006.4.4-4.12
File Structure
226544c9dc557106300e4bcd139fa882
Malicious
[Repaired @0x000DAF68]
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc
Resources
Malicious
RT_CURSOR
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
RT_BITMAP
ID:0000
ID:0
RT_ICON
ID:0001
ID:0
ID:1055
RT_DIALOG
ID:0000
ID:0
RT_STRING
ID:0FE9
ID:0
ID:0FEA
ID:0
ID:0FEB
ID:0
ID:0FEC
ID:0
ID:0FED
ID:0
ID:0FEE
ID:0
ID:0FEF
ID:0
ID:0FF0
ID:0
ID:0FF1
ID:0
ID:0FF2
ID:0
ID:0FF3
ID:0
ID:0FF4
ID:0
ID:0FF5
ID:0
ID:0FF6
ID:0
ID:0FF7
ID:0
ID:0FF8
ID:0
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFC
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
ID:1000
ID:0
RT_RCDATA
Malicious
ID:0000
Malicious
ID:0
[Authenticode]_a5789547.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.idata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
ID:1055
Malicious
[Content_Types].xml
_rels
.rels
xl
_rels
workbook.xml.rels
workbook.xml
vbaProject.bin
Root Entry
PROJECT
PROJECTwm
VBA
dir
__SRP_0
__SRP_1
__SRP_2
__SRP_3
ThisWorkbook

ThisWorkbook

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
_VBA_PROJECT
theme
theme1.xml
styles.xml
worksheets
sheet1.xml
docProps
core.xml
app.xml
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
CODE
DATA
BSS
.idata
.edata
.reloc
.rsrc
Resources
RT_RCDATA
ID:0000
ID:0
RT_GROUP_CURSOR2
ID:7FF9
ID:0
ID:7FFA
ID:0
ID:7FFB
ID:0
ID:7FFC
ID:0
ID:7FFD
ID:0
ID:7FFE
ID:0
ID:7FFF
ID:0
RT_GROUP_CURSOR4
ID:0000
ID:1055
RT_VERSION
ID:0001
ID:1055
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Artefacts
Name
 Value
URLs in VB Code - #1

http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
URLs in VB Code - #2

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
URLs in VB Code - #3

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
URLs in VB Code - #4

http://xred.site50.net/syn/SUpdate.ini
URLs in VB Code - #5

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
URLs in VB Code - #6

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
URLs in VB Code - #7

http://xred.site50.net/syn/Synaptics.rar
URLs in VB Code - #8

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
URLs in VB Code - #9

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
URLs in VB Code - #10

http://xred.site50.net/syn/SSLLibrary.dll
URLs in VB Code - #11

http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%200a
URLs in VB Code - #12

http://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0
URLs in VB Code - #13

http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
URLs in VB Code - #14

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
URLs in VB Code - #15

http://www.microsoft.com/windows0
URLs in VB Code - #16

http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l
URLs in VB Code - #17

http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0
URLs in VB Code - #18

http://www.microsoft.com/pkiops/Docs/Repository.htm0
URLs in VB Code - #1

http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%200a
URLs in VB Code - #2

http://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0
URLs in VB Code - #3

http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
URLs in VB Code - #4

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
URLs in VB Code - #5

http://www.microsoft.com/windows0
URLs in VB Code - #6

http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l
URLs in VB Code - #7

http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0
URLs in VB Code - #8

http://www.microsoft.com/pkiops/Docs/Repository.htm0
URLs in VB Code - #1

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
URLs in VB Code - #2

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
URLs in VB Code - #1

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
URLs in VB Code - #2

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
226544c9dc557106300e4bcd139fa882 (916.48 KB)
File Structure
226544c9dc557106300e4bcd139fa882
Malicious
[Repaired @0x000DAF68]
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc
Resources
Malicious
RT_CURSOR
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
RT_BITMAP
ID:0000
ID:0
RT_ICON
ID:0001
ID:0
ID:1055
RT_DIALOG
ID:0000
ID:0
RT_STRING
ID:0FE9
ID:0
ID:0FEA
ID:0
ID:0FEB
ID:0
ID:0FEC
ID:0
ID:0FED
ID:0
ID:0FEE
ID:0
ID:0FEF
ID:0
ID:0FF0
ID:0
ID:0FF1
ID:0
ID:0FF2
ID:0
ID:0FF3
ID:0
ID:0FF4
ID:0
ID:0FF5
ID:0
ID:0FF6
ID:0
ID:0FF7
ID:0
ID:0FF8
ID:0
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFC
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
ID:1000
ID:0
RT_RCDATA
Malicious
ID:0000
Malicious
ID:0
[Authenticode]_a5789547.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.idata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
ID:1055
Malicious
[Content_Types].xml
_rels
.rels
xl
_rels
workbook.xml.rels
workbook.xml
vbaProject.bin
Root Entry
PROJECT
PROJECTwm
VBA
dir
__SRP_0
__SRP_1
__SRP_2
__SRP_3
ThisWorkbook

ThisWorkbook

[Stored VBA]
Malicious
[PCode]
[Decompiled VBA]
Malicious
_VBA_PROJECT
theme
theme1.xml
styles.xml
worksheets
sheet1.xml
docProps
core.xml
app.xml
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
CODE
DATA
BSS
.idata
.edata
.reloc
.rsrc
Resources
RT_RCDATA
ID:0000
ID:0
RT_GROUP_CURSOR2
ID:7FF9
ID:0
ID:7FFA
ID:0
ID:7FFB
ID:0
ID:7FFC
ID:0
ID:7FFD
ID:0
ID:7FFE
ID:0
ID:7FFF
ID:0
RT_GROUP_CURSOR4
ID:0000
ID:1055
RT_VERSION
ID:0001
ID:1055
Characteristics

vbaDNA - VBA Stomping & Purging Stategy detection

Module Name
ThisWorkbook
Blacklist VBA
VBA Macro
No malware configuration were found at this point.
Artefacts
Name
 Value Location
URLs in VB Code - #1

http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #2

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #3

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #4

http://xred.site50.net/syn/SUpdate.ini

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #5

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #6

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #7

http://xred.site50.net/syn/Synaptics.rar

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #8

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #9

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #10

http://xred.site50.net/syn/SSLLibrary.dll

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #11

http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%200a

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #12

http://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #13

http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #14

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #15

http://www.microsoft.com/windows0

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #16

http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #17

http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #18

http://www.microsoft.com/pkiops/Docs/Repository.htm0

226544c9dc557106300e4bcd139fa882
URLs in VB Code - #1

http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%200a

226544c9dc557106300e4bcd139fa882 > Resources > RT_RCDATA > ID:0000 > ID:0
URLs in VB Code - #2

http://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0

226544c9dc557106300e4bcd139fa882 > Resources > RT_RCDATA > ID:0000 > ID:0
URLs in VB Code - #3

http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z

226544c9dc557106300e4bcd139fa882 > Resources > RT_RCDATA > ID:0000 > ID:0
URLs in VB Code - #4

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0

226544c9dc557106300e4bcd139fa882 > Resources > RT_RCDATA > ID:0000 > ID:0
URLs in VB Code - #5

http://www.microsoft.com/windows0

226544c9dc557106300e4bcd139fa882 > Resources > RT_RCDATA > ID:0000 > ID:0
URLs in VB Code - #6

http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l

226544c9dc557106300e4bcd139fa882 > Resources > RT_RCDATA > ID:0000 > ID:0
URLs in VB Code - #7

http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0

226544c9dc557106300e4bcd139fa882 > Resources > RT_RCDATA > ID:0000 > ID:0
URLs in VB Code - #8

http://www.microsoft.com/pkiops/Docs/Repository.htm0

226544c9dc557106300e4bcd139fa882 > Resources > RT_RCDATA > ID:0000 > ID:0
URLs in VB Code - #1

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

226544c9dc557106300e4bcd139fa882 > Resources > RT_RCDATA > ID:0000 > ID:1055 > xl > vbaProject.bin > Root Entry > VBA > ThisWorkbook > [Stored VBA]
URLs in VB Code - #2

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

226544c9dc557106300e4bcd139fa882 > Resources > RT_RCDATA > ID:0000 > ID:1055 > xl > vbaProject.bin > Root Entry > VBA > ThisWorkbook > [Stored VBA]
URLs in VB Code - #1

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

226544c9dc557106300e4bcd139fa882 > Resources > RT_RCDATA > ID:0000 > ID:1055 > xl > vbaProject.bin > Root Entry > VBA > ThisWorkbook > [Decompiled VBA]
URLs in VB Code - #2

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

226544c9dc557106300e4bcd139fa882 > Resources > RT_RCDATA > ID:0000 > ID:1055 > xl > vbaProject.bin > Root Entry > VBA > ThisWorkbook > [Decompiled VBA]
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙