Malicious
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Detection
PeID
Armadillo v4.xMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
5 malicious · 25 files
EXEe4a3af9d7e118bc379d0281c1d85b677T1059.005
Structure
RAROverlay_03f7e775.binT1059.005
VBSSendMail.vbeT1059.005
VBSSendMail.vbe.decoded.vbsT1059.005
VBSSendMail.vbe.decoded.vbs.deobfuscated.vbsT1059.005
BINResources
| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_03f7e775.bin (1433 bytes) |
| Info | PDB Path: d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb |
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #6
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #7
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential