Malicious
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Detection
PeID
Armadillo v4.xMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
6 malicious · 35 files
EXE6c2ee13d637d438e2844af85679064bfT1059.005
Structure
RAROverlay_583131d1.binT1059.005
PDFCassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf
VBSHideMake.vbs
VBSDwn.vbeT1059.005
VBSDwn.vbe.decoded.vbsT1059.005
VBSDwn.vbe.decoded.vbs.deobfuscated.vbsT1059.005
BATclean.bat
BATmake.bat
BINResources
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_583131d1.bin (17543 bytes) |
| Info | PDB Path: d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | 1.3 |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | — |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | D:20170215083144+02'00' |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | — |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | — |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | D:20170215083144+02'00' |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | — |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | — |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | null |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | null |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | — |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | — |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | — |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | — |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | — |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | D:20170215083144+02'00' |
| Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf | D:20170215083144+02'00' |
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential