Malicious
ec1014bdf325da8f289cd236fecf068c
PE Executable
MD5: ec1014bdf325da8f289cd236fecf068c
Size: 1.66 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | ec1014bdf325da8f289cd236fecf068c |
| Sha1 | d40621fdfe1a9f29b4059761260bb76e42aa46f7 |
| Sha256 | faa2ffa4498542a73f97ca66525fe785788559665b0a553a322d5ccefa7bf473 |
| Sha384 | 80a078bb2ed88fbe4b081f307959d8f5a285a4fcb3f952ba8ac41dc1844b1bbdbb5e5a75949c82ae30a3f134fb0723de |
| Sha512 | 784eb0efdb2b50b91dc33a7d23ea8f500e5f71137dffed2c65e1f8ff493f5df80a089e2c02eafeb8260668947cf711ae0659d8bc259b460adf11b50012c8f292 |
| SSDeep | 24576:1nsJ39LyjbJkQFMhmC+6GD9Yj7wWV6T/+vzI1qbFv:1nsHyjtk2MYC5GD9WVw+vzxFv |
| TLSH | 95758DA2F1908877D4670AB59C2BE2301467BE986D74510D2BE97F0F7AB3342345EE4B |
PeID
BobSoft Mini Delphi -> BoB / BobSoftBorland Delphi 4.0Borland Delphi v3.0Borland Delphi v6.0 - v7.0Borland Delphi v6.0 - v7.0D1S1G v1.1 beta --> D1ND1S1G v1.1 beta --> D1NMicrosoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12
Malicious
Malicious
| Name | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
Malicious
No malware configuration was found at this point.
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ec1014bdf325da8f289cd236fecf068c › [Repaired @0x0018F5B8] › xl › vbaProject.bin › Root Entry › VBA › ThisWorkbook › [Decompiled VBA]
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ec1014bdf325da8f289cd236fecf068c › [Repaired @0x0018F5B8] › xl › vbaProject.bin › Root Entry › VBA › ThisWorkbook › [Decompiled VBA]
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ec1014bdf325da8f289cd236fecf068c › [Repaired @0x0018F5B8] › xl › vbaProject.bin › Root Entry › VBA › ThisWorkbook › [Stored VBA]
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
ec1014bdf325da8f289cd236fecf068c › [Repaired @0x0018F5B8] › xl › vbaProject.bin › Root Entry › VBA › ThisWorkbook › [Stored VBA]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.