Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
FileType
Portable Executable file
DetectionPeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ v6.0 DLL
17 malicious · 12336 files
EXEd94e4728855a86994ee14aff026c574ePE32 x86
Structure
RAROverlay_82a5d4ab.binoverlay · Rar Archive
ICOaxionMC.icoextracted from Rar Archive
VBScreate_shortcuts.vbsextracted from Rar Archive · VBScript
BATmcgui.batextracted from Rar Archive
BATmcguidebug.batextracted from Rar Archive
VBSjava_update.vbsextracted from Rar Archive · VBScript
BATjava_update.batextracted from Rar Archive
EXEruncmd.exeextracted from Rar Archive · PE32 x86
VBSsxa_uninstall.vbsextracted from Rar Archive · VBScript
OFFAllEvents.rptextracted from Rar Archive · MS Office Document
TXTAVAMAR-MCS-MIB.txtextracted from Rar Archive
OFFClientInstallation.rptextracted from Rar Archive · MS Office Document
OFFErrorWarningEvents.rptextracted from Rar Archive · MS Office Document
PS1event_catalog.htmlextracted from Rar Archive · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
BIN[Base64-Block]decoded · base64
PS1event_catalog.txtextracted from Rar Archive · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
BIN[Base64-Block]decoded · base64
PS1event_summary.txtextracted from Rar Archive · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1event_summary_ext.txtextracted from Rar Archive · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
OFFFailedRestores.rptextracted from Rar Archive · MS Office Document
OFFFailedSnapup.rptextracted from Rar Archive · MS Office Document
OFFGroupSnapupByGroup.rptextracted from Rar Archive · MS Office Document
OFFGroupSnapupByScheduled.rptextracted from Rar Archive · MS Office Document
TXTplugin_catalog.txtextracted from Rar Archive
TXTplugin_catalog_summary.txtextracted from Rar Archive
OFFServerDriveCapacity.rptextracted from Rar Archive · MS Office Document
OFFSuccessfulRestores.rptextracted from Rar Archive · MS Office Document
OFFSuccessfulSnapup.rptextracted from Rar Archive · MS Office Document
TXTThirdPartyToolsLic.txtextracted from Rar Archive
| Name |
Value |
|---|
| Info |
Overlay extracted: Overlay_82a5d4ab.bin (21568846 bytes) |
| Info |
PDB Path: d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb |
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
17 malicious · 12336 files
EXEd94e4728855a86994ee14aff026c574ePE32 x86
Structure
RAROverlay_82a5d4ab.binoverlay · Rar Archive
ICOaxionMC.icoextracted from Rar Archive
VBScreate_shortcuts.vbsextracted from Rar Archive · VBScript
BATmcgui.batextracted from Rar Archive
BATmcguidebug.batextracted from Rar Archive
VBSjava_update.vbsextracted from Rar Archive · VBScript
BATjava_update.batextracted from Rar Archive
EXEruncmd.exeextracted from Rar Archive · PE32 x86
VBSsxa_uninstall.vbsextracted from Rar Archive · VBScript
OFFAllEvents.rptextracted from Rar Archive · MS Office Document
TXTAVAMAR-MCS-MIB.txtextracted from Rar Archive
OFFClientInstallation.rptextracted from Rar Archive · MS Office Document
OFFErrorWarningEvents.rptextracted from Rar Archive · MS Office Document
PS1event_catalog.htmlextracted from Rar Archive · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
BIN[Base64-Block]decoded · base64
PS1event_catalog.txtextracted from Rar Archive · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
BIN[Base64-Block]decoded · base64
PS1event_summary.txtextracted from Rar Archive · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1event_summary_ext.txtextracted from Rar Archive · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
OFFFailedRestores.rptextracted from Rar Archive · MS Office Document
OFFFailedSnapup.rptextracted from Rar Archive · MS Office Document
OFFGroupSnapupByGroup.rptextracted from Rar Archive · MS Office Document
OFFGroupSnapupByScheduled.rptextracted from Rar Archive · MS Office Document
TXTplugin_catalog.txtextracted from Rar Archive
TXTplugin_catalog_summary.txtextracted from Rar Archive
OFFServerDriveCapacity.rptextracted from Rar Archive · MS Office Document
OFFSuccessfulRestores.rptextracted from Rar Archive · MS Office Document
OFFSuccessfulSnapup.rptextracted from Rar Archive · MS Office Document
TXTThirdPartyToolsLic.txtextracted from Rar Archive
No malware configuration was found at this point.
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
d94e4728855a86994ee14aff026c574e › Overlay_82a5d4ab.bin › bin › create_shortcuts.vbs
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Coming soon: export of this report's indicators to MISP and EDR platforms.
