Malicious
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Corrupted Microsoft Office Document
Detection
PeID
BobSoft Mini Delphi -> BoB / BobSoftBorland Delphi 4.0Borland Delphi v3.0Borland Delphi v6.0 - v7.0Borland Delphi v6.0 - v7.0D1S1G v1.1 beta --> D1ND1S1G v1.1 beta --> D1NMicrosoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12UPolyX 0.3 -> delikon
4 malicious · 60 files
EXE880a15ca0dcba93d0f93390af98e20d1XBinder
Structure
XLS[Repaired @0x0169D7DC]
XML[Content_Types].xml
BIN_rels
BINxl
BIN_rels
XMLworkbook.xml
OFFvbaProject.bin
BINRoot Entry
BINPROJECT
BINPROJECTwm
BINVBA
BINdir
BIN__SRP_0
BIN__SRP_1
BIN__SRP_2
BIN__SRP_3
VBAThisWorkbook
VBS[Stored VBA]
VBA[PCode]
VBS[Decompiled VBA]
BIN_VBA_PROJECT
BINtheme
XMLstyles.xml
BINworksheets
BINdocProps
BINResources
| Config. Field | Value |
|---|---|
| ref_elem_0x0000000E | 99.exehuhuhuhuhuhuhu |
| ref_elem_0x00000016 | w.exe-huhuhuhuhuhuhu |
| 3M9TMlHKhbPnmMouI80AWkiEoR | %Aphuhuhuhu |
| 0FUUzAFM2o0Zv4NNn7cbs4KImi | -huhuhuhu |
| uR2gA3pgUY6u7QoACO3esLqxKj | koFrthuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential