Malicious
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Detection
PeID
Borland Delphi 7 - Nstd EP - ASL sign HQR data fileMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ v6.0 DLLMicrosoft WAV Audio filePureBasic DLL -> Neil HodgsonUPolyX 0.3 -> delikon
3 malicious · 865 files
EXE9edf2ea67490be79d8b2913d6e5887acXWorm
Structure
7Z7z-stream @ 0x0095649F.7zXWorm
BINResources
BINRT_ICON
BINRT_RCDATA
BINID:0000
BINID:0
Structure
7Z7z-stream @ 0x00945C77.7z
BINResources
BIN.Net Resources
BINXworm.About.resources
BINXworm.ACT.resources
BINXworm.Chat.resources
BINXworm.Clipper.resources
BINXworm.CustomOpen.resources
BINXworm.DDosAttack.resources
BINXworm.EditReg.resources
BINXworm.FilesSearcher.resources
BINXworm.FM.resources
BINXworm.Builder.resources
BINXworm.Clipboard.resources
BINXworm.Hash.resources
BINXworm.HBrowser.resources
BINXworm.Main.resources
BINXworm.HVNC.resources
BINXworm.HApps.resources
BINXworm.Ftp.resources
BINXworm.Fun.resources
BINXworm.Hosts.resources
BINXworm.INFO.resources
BINXworm.Keylogger.resources
BINXworm.Maps.resources
BINXworm.MBox.resources
BINXworm.MIC.resources
BINXworm.ngrok.resources
BINXworm.Performance.resources
BINXworm.Port.resources
BINXworm.ProcessV.resources
BINXworm.Programs.resources
BINXworm.Proxy.resources
BINXworm.Ransomware.resources
BINXworm.Registry.resources
BINXworm.RemoteDesktop.resources
BINXworm.RunPE.resources
BINXworm.ServiceManager.resources
BINXworm.Sound.resources
BINXworm.StartupManager.resources
BINXworm.TBotNotify.resources
BINXworm.TcpConnectionForm.resources
BINXworm.Shell.resources
BINXworm.ToolsBox.resources
BINXworm.TXT.resources
BINXworm.VBCode.resources
BINXworm.VoiceChat.resources
BINXworm.WebCam.resources
7ZXworm.Resources.resourcesXWorm
BINCD
BINChat
BINFolder
BINHDD
BINInformation
BINIntro
BINNetwork
BINPlay
BINQuestion
BINUSB
BINWarning
EXE_7z
EXE_7zD
BIN_Error
BIN_Stop
7Z7z-stream @ 0x0018038B.7z
BINtqjnjpxujoir
BINRT_GROUP_CURSOR4
BINRT_VERSION
| Config. Field | Value |
|---|---|
| Mutex | abcdefhuhuhuhuhuhuhuhuhuhuhu |
| SPL | -huhuhuhu |
| KEY | abcdefhuhuhuhuhuhuhuhuhuhuhu |
| family | xhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #6
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #7
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #8
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #9
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #10
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #11
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Mutex
MUTEXmalicious
abcdefhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential