Malicious
Ctrl + scroll to zoom · drag to pan
The file c08d04309e30e4a6d105965c685f32f3 is a ZIP Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 91 embedded or derived files. It matches 4 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- —
- MD5
- -
- Verdict
- Malicious
- File type
- ZIP Archive
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
4 malicious · 92 files
ZIPc08d04309e30e4a6d105965c685f32f3CVE-2019-9674
OFFoverseated.tmpCVE-2019-9674
BINRoot Entry
DLLBabySrk.dll
ZIPresource.pngCVE-2019-9674
TMPemjio.tmp
EXEexcogitative.exe
DLLUpdateDriverSdk.dll
DLLvcruntime140_1.dll
DLLMSVCP140.dll
DLLVCRUNTIME140.dll
EXEflashcenter_pp_ax_install_cn.exe
TMPemjio.tmp
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #6
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #7
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #8
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #9
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #10
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #11
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #12
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #13
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #14
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #15
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #16
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #17
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential