virussign.com_9b11305a13a1e8905cd71cbca2ac0210.vir
VB6 malware renames exe, hides window, encrypted payload
VB6 file writer stages an exe payloadVB6 shell dropper stages an exe payload
SHA-2560f20ac3f51d55433be2094dec34cef3141a4c00f9efdb770bf8fdd6d3b9f0049
Evidence
⋯7 more rows
0x2286cda5b4a100000000000000000000000l.[J............
0x2384d535642564d36302e444c4c00000000MSVBVM60.DLL....
0x24800000000000000000000000000000000................
⋯15 more rows
⋯3 more rows
0xff000000000000000000000000000000000................
0x10008693a372f909a372ee6aa4723168a472...r...r.j.r1h.r
0x10108dcca1726272a47288bea072ba02a372...rbr.r...r...r
0x1020c39fa1724109a372766aa2723ac3a072...rA..rvj.r:..r
0x103074a2a1726e02a372fec1a17205cda172t..rn..r...r...r
0x10403acda1729d49a272f19fa1720603a372:..r.I.r...r...r
0x10500604a372ee94a372ea62a3727d41a172...r...r.b.r}A.r
0x1060749ba0726c57a272fda09472f609a372t..rlW.r...r...r
0x10700ac3a1729b05a272879ba07269cea072...r...r...ri..r
0x10809395a372859aa072df47a2728906a372...r...r.G.r...r
0x1090ba03a37213a5a4725057a2725ac6a172...r...rPW.rZ..r
0x10a04819a2727d69a2722b94a372103da172H..r}i.r+..r.=.r
0x10b037a2a1721856a272ea10a2723a03a3727..r.V.r...r:..r
0x10c03a04a372016ca2726e03a372a9fda272:..r.l.rn..r...r
0x10d0a43594722f4ea272db76a472c092a372.5.r/N.r.v.r...r
0x10e0306ca272edeea2724496a3722198a2720l.r...rD..r!..r
0x10f0134ea27211dda272ec6ba272af9fa172.N.r...r.k.r...r
0x11000000000000000000210014000ba04200........!.....B.
0x111000000000000000000000000020114000............ .@.
0x112008000000969e42009d9e4200ab9e4200......B...B...B.
0x1130ef9e4200439f4200559f4200a39f4200..B.C.B.U.B...B.
0x114004a04200000000002700140061a54200..B.....'...a.B.
0x1150a2a5420069a542000000000060114000..B.i.B.....`.@.
0x11600e00000075a0420085a0420093a04200....u.B...B...B.
0x1170b9a04200f9a2420021a3420038a34200..B...B.!.B.8.B.
0x118046a34200afa34200f5a3420085a44200F.B...B...B...B.
0x11909ca44200aaa442005aa5420000000000..B...B.Z.B.....
0x11a0000000000000000027001400c2a94200........'.....B.
0x11b005aa4200caa9420000000000c0114000..B...B.......@.
0x11c00700000029a6420030a642003ea64200....).B.0.B.>.B.
0x11d064a64200b9a642008fa84200bba94200d.B...B...B...B.
0x11e00000000000f60000000000000000f03f...............?
0x11f0000000001000f04025001400d4ad4200.......@%.....B.
0x120000000000dcad42000000000010124000......B.......@.
0x12100500000081aa420088aa420096aa4200......B...B...B.
0x1220c1ad4200cdad42000000000000000000..B...B.........
0x1230ff2558104000ff2588104000ff259410.%X.@..%..@..%..
0x12404000ff254c104000ff2534104000ff25@..%L.@..%4.@..%
0x1250bc104000ff251c104000ff25cc104000..@..%..@..%..@.
0x1260ff2550104000ff25c8104000ff25c010.%P.@..%..@..%..
0x12704000ff25901040008a256c104000ff25@..%..@..%l.@..%
0x14c900000001000200000131000200000022.........1....."
0x14d900000072013200020000001400000094...r.2..........
0x14e98769000400000001000000a8000000d4.i..............
0x14f90015f900000027100015f90000002710......'.......'.
0x150941646f62652050686f746f73686f7020Adobe Photoshop
0x151943432032303138202857696e646f7773CC 2018 (Windows
0x15292900323031393a30313a30372031393a).2019:01:07 19:
0x153934343a3237000003560100030000000144:27...V.......
0x154900010000a002000400000001000002ee................
0x1559a0030004000000010000032b00000000...........+....
0x15690000000601030003000000010006008d................
0x1579011a00050000000100000122011b0005..........."....
0x1589000000010000012a0128000300000001.......*.(......
0x159900020000020100040000000100000132...............2
0x15a902 .
0x42006c692073744576743a616374696f6e3dli stEvt:action=
0x421022636f6e566572746564222073744576"conVerted" stEv
0x4220743a706172616d65746572733d226672t:parameters="fr
0x42306f6d20696d6167652f706e6720746f20om image/png to
0x4240696d6167652f6a706567222f3e203c72image/jpeg"/> <r
0x425064663a6c692073744576743a6163a069df:li stEvt:ac.i
0x42606f6e3d22646572697665642220737445on="derived" stE
0x427076743a706172616d65746572733d2263vt:parameters="c
0x42806f6e7665727465642066726f6d20696donverted from im
0x42906167652f706e6720746f20696d616765age/png to image
0x42a02f6a706567222f3e203c7264663a6c69/jpeg"/> <rdf:li
0x42b02073744576743a616374696f6e3d2273 stEvt:action="s
0x42c061766564222073744576743a696e7374aved" stEvt:inst
0x42d0616e636549443d22786d702e6969643aanceID="xmp.iid:
0x42e064353937343839392d636138382d3766d5974899-ca88-7f
0x42f034322d393531362d386537363335383042-9516-8e763580
0x430038646633222073744576743a7768656e8df3" stEvt:when
0x43103d22323031392d30315c30375431393a="2019-01\07T19:
0x432034343a32372b30383a3030222073744544:27+08:00" stE
0x433076743a736f6674776172654167656e74vt:softwareAgent
0x43403d2241646f62652050686f746f73686f="Adobe Photosho
0x4350702043432032303138202857696e64 p CC 2018 (Wind
0x298a898e2978f05bf51e50f3df4e76d505b4b......Q..=..mP[K
0x298b88fe77fbba8fbf653e24ead339966cf11.......S.N.3.f..
0x298c8b70c00aa0060d3935465787431000000.....`..Text1...
0x298d82e3dfbfcfaa06810a73808002b3371b5.=....h..8..+3q.
0x298e8433a5c50726f6772616d2046696c6573C:\Program Files
0x298f82028783836295c4d6963726f736f6674 (x86)\Microsoft
0x299082056697375616c2053747564696f5c56 Visual Studio\V
0x299184239385c5642362e4f4c420056420000B98\VB6.OLB.VB..
0x29928d89842000000000006cc000009000000..B.............
0x29938e8984200249942dad0c2420000000000..B.$.B...B.....
0x2994800000000c86dae00da4ead339966cf11.....m...N.3.f..
0x29958b70c00aa0060d3934c6162656c310000.....`..Label1..
0x299683a4fad330866cf11b70c00aa0060d393:O.3.f.......`..
0x29978466f726d000000002a4fad339966cf11Form....*O.3.f..
0x29988b70c00aa0060d39354696d6572320000.....`..Timer2..
0x2999854696d65723100000700000075416572Timer1......uAer
0x299a8333200001b0000005365744c6179657232......SetLayer
0x299b8656457696e646f774174747269627574edWindowAttribut
0x299c865730000a4994200b099420000000400es....B...B.....
0x299d8d4c242000000000000000000a1dcc242..B............B
0x299e8000bc07402ffe068cc994200b8c01240...t...h..B....@
0x299f800ffd0ffe00000000f9d000047657457............GetW
0x29a08696e646f774c6f6e67410000a4994200indowLongA....B.
0x29a1804b5420000000400e0c2420000000000..B.......B.....
0x29a2800000000a1e8c242000bc07402ffe068.......B...t...h
0x29a38149a4200b8c0124000ffd0ffe0000000..B....@........
0x29a480f00000053657457696e646f774c6f6e....SetWindowLon
0x29a5867410000a49942004c9a420000000400gA....B.L.B.....
0x29a68ecc242000000000000000000a1f4c242..B............B
0x29a78000bc07402ffe0685c9a4200b8c01240...t...h\.B....@
0x29a8800ffd0ffe00000000c00500000000000..........P.....
0x29a9800000000233dfbfcfaa06810a7380800....#=....h..8..
0x29aa82b3371b5223dfbfcfaa06810a7380800+3q."=....h..8..
0x29ab82b3371b5020000009c9a4200ac9a4200+3q.......B...B.
0x29ac800000000794fad339966cf11b70c00aa....yO.3.f......
0x29ad80060d393020000005c00000008000000.`......\.......
0x29ae82e006500780065000000000016000000..e.x.e.........
0x29af804000000010000000000000000007301..............s.
0x29b08ffffffff01000000d94ead339966cf11.........N.3.f..
0x29b18b70c00aa0060d393120000005c005500.....`......\.U.
0x29b286e00690063006f0072006e002d000000n.i.c.o.r.n.-...
0x29b38e14ead339966cf11b70c00e00060d393.N.3.f.......`..
0x29b481e00000063ea6d00640020002f0063f4....c.m.d. ./.c.
0x29b582000720065006e0061006d0065002000 .r.e.n.a.m.e. .
0x29b68220000000c0000002e00650078006500".........e.x.e.
0x29b782200200000000000080020002e006400". ....... ...d.
0x29b886900650000000000564241362e444c4ci.e.....VBA6.DLL
0x29b98000000005f5f766261456e6400000000....__vbaEnd....