c9e376dde497836c7728a8e40d75d73a

PE Executable
|
MD5: c9e376dde497836c7728a8e40d75d73a
|
Size: 2.76 MB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	c9e376dde497836c7728a8e40d75d73a
Sha1	78f9c982efdec8599b9413c596d5b2717270a313
Sha256	5710a29e7dac1d7602761499787d03286faf7274d057888ceaf9f703a1e91617
Sha384	dd0f6db688fa080d28f9bfd310f89e10dffd2181106e1bf3ac7a495e6af0cb1eb17cfedda591a77fbafb17357c73f79f
Sha512	887e85542225be364081ad3489db0b558afc3224ae903407cedca6219cc20413752494f84e68e126da6bbb79597375247beb483d9495191004ee115af850f5ec
SSDeep	49152:cnsHyjtk2MYC5GDNnwJYNTm38/S+CqxM29DSF2WNjvOtEnqxVJMSNF8ZfK7bn0:cnsmtk2ae4KmMa+C0xsWgfUsfo0
TLSH	79D50232B2D28537D1721B3D8C6BA3A4992ABE512E38795F3BF41E4C5E3D2816C152D3

PeID

BobSoft Mini Delphi -> BoB / BobSoft

Borland Delphi 4.0

Borland Delphi v3.0

Borland Delphi v6.0 - v7.0

D1S1G v1.1 beta --> D1N

FishPE V1.1X -> hellfish

Microsoft Visual C++ v6.0 DLL

Pe123 v2006.4.4-4.12

File Structure

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)

Artefacts

Name0	Value
URLs in VB Code - #1	https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
URLs in VB Code - #2	https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
URLs in VB Code - #1	https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
URLs in VB Code - #2	https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

c9e376dde497836c7728a8e40d75d73a (2.76 MB)

File Structure

Characteristics

vbaDNA - VBA Stomping & Purging Stategy detection

	Module Name0
	ThisWorkbook	Blacklist VBA VBA Macro

No malware configuration were found at this point.

Artefacts

Name0	Value	Location
URLs in VB Code - #1	https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download	c9e376dde497836c7728a8e40d75d73a > [Repaired @0x0029D7B8] > xl > vbaProject.bin > Root Entry > VBA > ThisWorkbook > [Decompiled VBA]
URLs in VB Code - #2	https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	c9e376dde497836c7728a8e40d75d73a > [Repaired @0x0029D7B8] > xl > vbaProject.bin > Root Entry > VBA > ThisWorkbook > [Decompiled VBA]
URLs in VB Code - #1	https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download	c9e376dde497836c7728a8e40d75d73a > [Repaired @0x0029D7B8] > xl > vbaProject.bin > Root Entry > VBA > ThisWorkbook > [Stored VBA]
URLs in VB Code - #2	https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	c9e376dde497836c7728a8e40d75d73a > [Repaired @0x0029D7B8] > xl > vbaProject.bin > Root Entry > VBA > ThisWorkbook > [Stored VBA]

You must be signed in to post a comment.