Suspicious
Suspect

Share on LinkedIn
Print
MS Office Document
MD5: fe1b658db35d7c3418a0270b7143314e
Size: 6.33 MB
application/vnd.ms-office

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 fe1b658db35d7c3418a0270b7143314e
Sha1 6c503ebf7803fd2aae05c58a392cec2274f774ed
Sha256 9aec3a445e71559834feaff9d57d47d146b38d4732f7ad6adb46ba10e3ec2d9e
Sha384 65881b05d69e8b73a3ed05abdc643f9631b83aa55aa9dae9bbf10deb69e237aacd9d5fb396e13663eccbab1e4d43d7bd
Sha512 8bdb4056a6af22284d882805a5512a99be3fd3008db966cebcd9b032a352225459a2d23a40f62efc2e488bc92193387c8e337b428481bff7bcc50de02310f7fe
SSDeep 98304:poSTy8wkVMhhJqUUnZSlEL2flLjHS7qrMumgiJ/377pOjfJZTqQ2hKy7zaPO:pWvqQWqfNWgkRq4vhlv
TLSH 28560221B283C036D26E0177E969EF5E1978BE730B3105D777E87D6E49B08C2A275B06
fe1b658db35d7c3418a0270b7143314e
Root Entry
䡀䌏䈯
䡀㲞䈝䗻
䡀䈖䌧䠤
䡀䌋䄱䜵
䡀䌍䏤䊲
䡀䕎䒵䠵
䌋䄱䜵㷾䚨
䌋䄱䜵㾾䠳
䌧䎶䞁䄦䠥
䡀㬿䏲䐸䖱
䡀㽿䅤䈯䠶
䡀䈏䗤䕸䠨
䡀䈛䌪䗶䜵
䡀䋌䆨㫮䛲
䡀䒌䗱䒵䠯
䡀䓞䕪䇤䠨
䡀䕙䓲䕨䜷
䌋䄱䜵䌾䉱䠲
䡀䆊䌷䑲䈝䗻
䡀䈝䗻䗜䏼䠨
䡀䌍䈵䗦䕲䠼
䡀䒌䓰䑲䑨䠷
䌋䄱䜵䗾䅤䄥䎦
䡀㼿䕷䑬㭪䗤䠤
䡀㼿䕷䑬㹪䒲䠯
䡀㿿䏤䇬䗤䒬䠱
䡀䄛䌧㫲䗸䒷䠱
䡀䒌䗱䒵㮯䈹䗱
䡀䕌䄨䈷䒏䇯䕨
䡀䘌䗶䐲䆊䌷䑲
䡀䙎䑨㶷䓤䌳䊱
䌋䄱䜵䆾䐲䏳䗨䠬
䌋䄱䜵䆾䖸䌷䒦䠱
䌋䄱䜵䈾䆻䄯䌰䠦
䌋䄱䜵䌾䖱䌷䒦䠱
䌋䄱䜵䕾䐨䙲䆬䠲
䌋䄱䜵䕾䓨䌤䌵䠦
䌋䄱䜵䅾䑤䈱䞵䓭䠪
䌋䄱䜵䅾䑤䈱䞵䓭䠪-preview.png
䌋䄱䜵䅾䑤䈱䞵䙶䠪
䌋䄱䜵䅾䑤䈱䞵䙶䠪-preview.jpg
䌋䄱䜵䇾䄬䒯䞪䓭䠪
䌋䄱䜵䇾䄬䒯䞪䓭䠪-preview.png
䌋䄱䜵䇾䄬䒯䞪䙶䠪
䌋䄱䜵䇾䄬䒯䞪䙶䠪-preview.jpg
䌋䄱䜵䙾䈬䈺䞵䛨䠨
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
䡀䄕䑸䋦䒌䇱䗬䒬䠱
䡀䇊䌰㾱㼒䔨䈸䆱䠨
䡀䒌䗱䒵㬯䑲䌧䌷䑲
䌋䄱䜵䄾䆬䖸䄷䗦䇾䏯
[Authenticode]_e759eb73.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
REGISTRY
ID:27DA
ID:1033
RT_DIALOG
ID:2AB7
ID:1033
RT_STRING
ID:09C5
ID:1033
RT_VERSION
ID:0001
ID:1033
䌋䄱䜵䆾䇰䌯䎱䕤䒵䠺
䡀㲊㼿䋦䇨䏸䇨䄝䎶䠶
䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
䌋䄱䜵䄾䖬䋦䇨䏸䕨䞂䏧䠯
[Authenticode]_2fecb4f9.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
䡀䒋䗲䗶䄵䓳䕨㲞䈜䘴䑨䈦
䌋䄱䜵䅾䑤䈱䞵䆶䏤㡨㠅䍾䊳
䌋䄱䜵䅾䑤䈱䞵䆶䏤㡨㠅䍾䊳-preview.png
䌋䄱䜵䅾䑤䈱䞵䆶䏤㡨㥂䍾䊳
䌋䄱䜵䅾䑤䈱䞵䆶䏤㡨㥂䍾䊳-preview.png
䌋䄱䜵䅾䑤䈱䞵䆶䏤㢨㠀䍾䊳
䌋䄱䜵䅾䑤䈱䞵䆶䏤㢨㠀䍾䊳-preview.png
䌋䄱䜵䇾䄬䒯䞪䆶䏤㡨㠅䍾䊳
䌋䄱䜵䇾䄬䒯䞪䆶䏤㡨㠅䍾䊳-preview.png
䌋䄱䜵䇾䄬䒯䞪䆶䏤㡨㥂䍾䊳
䌋䄱䜵䇾䄬䒯䞪䆶䏤㡨㥂䍾䊳-preview.png
䌋䄱䜵䇾䄬䒯䞪䆶䏤㢨㠀䍾䊳
䌋䄱䜵䇾䄬䒯䞪䆶䏤㢨㠀䍾䊳-preview.png
SummaryInformation
fe1b658db35d7c3418a0270b7143314e
0x00023EC3.svg
0x000B81F3.svg
steam.exe
[Authenticode]_d6694f61.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.tp3
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
ID:000E
ID:1033
ID:000F
ID:1033
ID:0010
ID:1033
ID:0011
ID:1033
ID:0012
ID:1033
RT_MENU
ID:0000
ID:1033
RT_DIALOG
ID:0067
ID:1033
RT_STRING
ID:0007
ID:1033
RT_ACCELERATOR
ID:0000
ID:1033
RT_GROUP_CURSOR4
ID:006B
ID:1033
ID:006C
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
tpsvcBase.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.vmp0
.vmp1
.reloc
.rsrc
Resources
RT_MANIFEST
ID:0002
ID:1033
URLs in VB Code - #1 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5 URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #6 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #7 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #8 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #9 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #10 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #11 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #12 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #13 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #14 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #15 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #16 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #17 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #18 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #19 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #6 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #7 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #8 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #9 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #10 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #11 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙