Malicious
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Detection
PeID
MASM/TASM - sig4 (h)Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLL
4 malicious · 77 files
EXEda9f041b892abb81992953cced442dafT1059.005XWorm
7Z7z-stream @ 0x0011D588.7z
EXEOverlay_6dcd1044.binT1059.005
Structure
P7B[Authenticode]_2d378130.p7b
BINOverlay_b04071df.bin
BINResources
BINARM_UI_INI
BINID:0083
VBSID:1033T1059.005
VBSID:1033.deobfuscated.vbsT1059.005
BINRT_CURSOR
BINRT_BITMAP
BINRT_ICON
BINRT_MENU
BINRT_DIALOG
BINRT_STRING
BINRT_GROUP_CURSOR2
BINRT_GROUP_CURSOR4
BINRT_VERSION
BINRT_MANIFEST
EXE[Rebuild from dump]_a55c4802.exeXWorm
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_6dcd1044.bin (1240856 bytes) |
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #6
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #7
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #8
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #9
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #10
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #11
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #12
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #13
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #14
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #15
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #16
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #17
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #18
URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #19
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #20
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #21
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential