Malicious PE Executable analysis – 2ebd76c7d0c0 | Malva.RE

Malicious

Share on LinkedIn

PE Executable

MD5:

Size: 0 B

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation

4 malicious · 27 files

EXE2ebd76c7d0c0ca119817183dae7c6260

Structure

P7B[Authenticode]_55f4f35f.p7b

BINResources

BINRT_ICON

BINRT_MENU

BINRT_DIALOG

BINRT_ACCELERATOR

BINRT_RCDATA

BINID:0000

IMGID:1033

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN[Base64-Block]

IMGID:1033-preview.png

EXIFID:1033.exif

BINRT_GROUP_CURSOR4

BINRT_VERSION

BINRT_MANIFEST

Name	Value
Info	Authenticode present at 0x47EA00 size 10296 bytes

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #4 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #5 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #6 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #7 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #8 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #9 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #10 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #11 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #12 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #13 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #14 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #15 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #16 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #17 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #18 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #19 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #20 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #21 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #22 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #23 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #24 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #25 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #26 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #27 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #28 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #29 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #30 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #31 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #32 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #33 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #34 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #35 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #36 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #37 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #38 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #39 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #40 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #41 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #42 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #43 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #44 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #45 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #46 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #47 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #48 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #49 URIsuspect

fihuhuhuhu

URLs in VB Code - #50 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #51 URIsuspect

https:huhuhuhuhuhuhu

URLs in VB Code - #52 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #53 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #54 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #55 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #56 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #57 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #58 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #59 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #60 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #61 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #62 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #63 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #64 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #65 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #66 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #67 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #68 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #69 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #70 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #71 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #72 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #73 URIsuspect

https:huhuhuhuhuhuhu

URLs in VB Code - #74 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #75 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #76 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #77 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #78 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #79 URIsuspect

https:huhuhuhuhuhuhu

URLs in VB Code - #80 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #81 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #82 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #83 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #84 URIsuspect

https:huhuhuhuhuhuhu

URLs in VB Code - #85 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #86 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #87 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #88 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #89 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #90 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #91 URIsuspect

http:huhuhuhuhuhuhu

URLs in VB Code - #92 URIsuspect

http:huhuhuhuhuhuhu

URLs in VB Code - #93 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #94 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #95 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #96 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #97 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #98 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #99 URIsuspect

https:huhuhuhuhuhuhu

URLs in VB Code - #100 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #101 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #102 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #103 URIsuspect

http:/huhuhuhuhuhuhu

URLs in VB Code - #104 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #105 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #106 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #107 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #108 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #109 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙