Malicious PE Executable analysis – 87d5fbaa3cd6

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Type

Portable Executable file

Detection

PeID

Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8.0Microsoft Visual C++ 8.0Microsoft Visual C++ v6.0 DLL

3 malicious · 781 files

EXE87d5fbaa3cd647071c51df0e07443c6f

Structure

BINResources

BINRT_RCDATA

BINID:0065

ZIPID:1033

EXE_decimal.pyd

EXE_elementtree.pyd

EXE_hashlib.pyd

EXE_lzma.pyd

EXE_msi.pyd

EXE_multiprocessing.pyd

EXE_overlapped.pyd

EXE_queue.pyd

EXE_socket.pyd

EXE_sqlite3.pyd

EXE_ssl.pyd

EXE_uuid.pyd

EXE_zoneinfo.pyd

PDFfile.pdf

DLLlibcrypto-3.dll

DLLlibffi-8.dll

DLLlibssl-3.dll

TXTLICENSE.txt

EXEpyexpat.pyd

CATpython.cat

EXEpython.exe

DLLpython3.dll

_PTHpython311._pth

DLLpython311.dll

ZIPpython311.zip

EXEpythonw.exe

PYrun.py

EXEselect.pyd

DLLsqlite3.dll

EXEunicodedata.pyd

DLLvcruntime140.dll

EXEwinsound.pyd

BINmacOS

VBSrun.py

VBSrun.py.deobfuscated.vbs

BINSecurity.bin

EXE_asyncio.pyd

EXE_bz2.pyd

EXE_ctypes.pyd

BINRT_MANIFEST

Name	Value
Info	PDB Path: C:\Users\Admin\Documents\bot\TMT\DLL CU\DLL CU\Debug\oledlg.pdb
file.pdf	1.3
file.pdf	anonymous
file.pdf	D:20250716171346+00'00'
file.pdf	ReportLab PDF Library - www.reportlab.com
file.pdf	—
file.pdf	D:20250716171346+00'00'
file.pdf	unspecified
file.pdf	untitled
file.pdf	ReportLab PDF Library - www.reportlab.com
file.pdf	anonymous
file.pdf	D:20250716171346+00'00'
file.pdf	ReportLab PDF Library - www.reportlab.com
file.pdf	—
file.pdf	D:20250716171346+00'00'
file.pdf	ReportLab PDF Library - www.reportlab.com
file.pdf	unspecified
file.pdf	untitled

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential