cef4eb76c55cec6a28aad1ce08dbf61c

PE Executable
|
MD5: cef4eb76c55cec6a28aad1ce08dbf61c
|
Size: 4.45 MB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	cef4eb76c55cec6a28aad1ce08dbf61c
Sha1	acf710f210e01a9162fd69b668205c898892d948
Sha256	11dee89c0ea7cb7142d3edd87bf1888f3d559ab6752f0762b123e60bbb0cdac9
Sha384	9b0462ebceddddf839a1e9ddba43e227d67a2f6f6b5adb52ccc5b13b786f1aa234070dab48dc7a8b6842be3ffa9893bb
Sha512	86bf59596c9546ac1f9b34f7e1e4b96349fd8fa15872e511ade025547cdeb23c8b0625241781ccd87118ee063ed8d68b32a7158f892248c21bfcc8c91a6006c0
SSDeep	98304:ensmtk2aPskDP1dOcd6cy2LkZkkd0sAon:gLYOMy2LkZ71
TLSH	D7269D292B924262C3513738CC76A6A425796F131F18D4766EB42D4D7D3228EFC13EBE

PeID

BobSoft Mini Delphi -> BoB / BobSoft

Borland Delphi 4.0

Borland Delphi v3.0

Borland Delphi v6.0 - v7.0

D1S1G v1.1 beta --> D1N

MSVC++ v.8 (procedure 1 recognized - h)

Microsoft Visual C++ 6.0 DLL (Debug)

Microsoft Visual C++ 7.0 - 8.0

Microsoft Visual C++ 8.0

Microsoft Visual C++ v6.0 DLL

Pe123 v2006.4.4-4.12

File Structure

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)

Artefacts

Name0	Value
URLs in VB Code - #1	https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
URLs in VB Code - #2	https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
URLs in VB Code - #1	https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
URLs in VB Code - #2	https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

cef4eb76c55cec6a28aad1ce08dbf61c (4.45 MB)

File Structure

Characteristics

vbaDNA - VBA Stomping & Purging Stategy detection

	Module Name0
	ThisWorkbook	Blacklist VBA VBA Macro

No malware configuration were found at this point.

Artefacts

Name0	Value	Location
URLs in VB Code - #1	https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download	cef4eb76c55cec6a28aad1ce08dbf61c > [Repaired @0x00438A48] > xl > vbaProject.bin > Root Entry > VBA > ThisWorkbook > [Stored VBA]
URLs in VB Code - #2	https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	cef4eb76c55cec6a28aad1ce08dbf61c > [Repaired @0x00438A48] > xl > vbaProject.bin > Root Entry > VBA > ThisWorkbook > [Stored VBA]
URLs in VB Code - #1	https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download	cef4eb76c55cec6a28aad1ce08dbf61c > [Repaired @0x00438A48] > xl > vbaProject.bin > Root Entry > VBA > ThisWorkbook > [Decompiled VBA]
URLs in VB Code - #2	https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	cef4eb76c55cec6a28aad1ce08dbf61c > [Repaired @0x00438A48] > xl > vbaProject.bin > Root Entry > VBA > ThisWorkbook > [Decompiled VBA]

You must be signed in to post a comment.