Malicious PE Executable analysis – ec56c388a07e

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Type

Portable Executable file

Detection

PeID

Armadillo v4.xMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation

5 malicious · 126 files

EXEec56c388a07e13cd89e15cbaffb82e00

Structure

RAROverlay_ab896c24.bin

CONFConfReader.conf

BATdownload.bat

VBSGetIP.vbs

BAThfu.bat

EXEHFUservice.exe

VBSHideCalc.vbs

VBShidedown.vbs

EXEHistory.exe

DLLlibcurl.dll

DLLmsvcp100.dll

DLLmsvcr100.dll

BATsample.bat

EXESendSMTP.exe

EXEwget.exe

BATDown.bat

BINResources

Name	Value
Info	Overlay extracted: Overlay_ab896c24.bin (1426620 bytes)
Info	PDB Path: d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential