9f2440e8a4a561d80fabd0550927fd94

PE Executable
|
MD5: 9f2440e8a4a561d80fabd0550927fd94
|
Size: 6.09 MB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	9f2440e8a4a561d80fabd0550927fd94
Sha1	9bcb5ca6600ef4373923b7706138b69695678f2e
Sha256	19e59830b3b6742b26575bc2b1ec3276a5d7d75a7f3c92bf0cf5762f07e9f660
Sha384	64d22d11f64201471c2b717204dcfdb2d53c786ef26b8dcf4bd748048ca4a21a1e4b6e40f666d0c4e0aa23d0fb1afe74
Sha512	1b6a6b287d016b736567ee92f778b7bf0296d8d271efb6fcd375c65ba799ce7ffe78c64938757734627152b5e17553947a4976d725bb4a0ab3aed30ccdf1b04b
SSDeep	98304:unsmtk2aQws2ANnKXOaeOgmhIguwdIaiqPNZVGEmmrQh1Sz1:wLrKXbeO7ugXviq3sEmmrl
TLSH	ED56CF13B1860536C2854A31CD63DAB24B3A7E6D2BF74977BAD87DC8BF392403D25612

PeID

BobSoft Mini Delphi -> BoB / BobSoft

Borland Delphi 4.0

Borland Delphi v3.0

Borland Delphi v6.0 - v7.0

D1S1G v1.1 beta --> D1N

Microsoft Visual C++ 6.0 DLL (Debug)

Microsoft Visual C++ 7.0 - 8.0

Microsoft Visual C++ v6.0 DLL

Pe123 v2006.4.4-4.12

File Structure

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)

Artefacts

Name0	Value
URLs in VB Code - #1	https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
URLs in VB Code - #2	https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
URLs in VB Code - #1	https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
URLs in VB Code - #2	https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

9f2440e8a4a561d80fabd0550927fd94 (6.09 MB)

File Structure

Characteristics

vbaDNA - VBA Stomping & Purging Stategy detection

	Module Name0
	ThisWorkbook	Blacklist VBA VBA Macro

No malware configuration were found at this point.

Artefacts

Name0	Value	Location
URLs in VB Code - #1	https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download	9f2440e8a4a561d80fabd0550927fd94 > [Repaired @0x005CB208] > xl > vbaProject.bin > Root Entry > VBA > ThisWorkbook > [Stored VBA]
URLs in VB Code - #2	https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	9f2440e8a4a561d80fabd0550927fd94 > [Repaired @0x005CB208] > xl > vbaProject.bin > Root Entry > VBA > ThisWorkbook > [Stored VBA]
URLs in VB Code - #1	https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download	9f2440e8a4a561d80fabd0550927fd94 > [Repaired @0x005CB208] > xl > vbaProject.bin > Root Entry > VBA > ThisWorkbook > [Decompiled VBA]
URLs in VB Code - #2	https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	9f2440e8a4a561d80fabd0550927fd94 > [Repaired @0x005CB208] > xl > vbaProject.bin > Root Entry > VBA > ThisWorkbook > [Decompiled VBA]

You must be signed in to post a comment.