virussign.com_834f23c6759d83a5fbbf5f0e6bd36da0.vir
Kawaii-Unicorn malware
VB6 file writer stages an exe payloadVB6 shell dropper stages an exe payload
SHA-25621a5cb1ca1c9aa5efc8205c86a6c0e94daf5cef09b7b3b430d563ec90537280a
Evidence
⋯7 more rows
0x2286cda5b4a100000000000000000000000l.[J............
0x2384d535642564d36302e444c4c00000000MSVBVM60.DLL....
0x24800000000000000000000000000000000................
⋯15 more rows
⋯3 more rows
0xff000000000000000000000000000000000................
0x10008693a372f909a372ee6aa4723168a472...r...r.j.r1h.r
0x10108dcca1726272a47288bea072ba02a372...rbr.r...r...r
0x1020c39fa1724109a372766aa2723ac3a072...rA..rvj.r:..r
0x103074a2a1726e02a372fec1a17205cda172t..rn..r...r...r
0x10403acda1729d49a272f19fa1720603a372:..r.I.r...r...r
0x10500604a372ee94a372ea62a3727d41a172...r...r.b.r}A.r
0x1060749ba0726c57a272fda09472f609a372t..rlW.r...r...r
0x10700ac3a1729b05a272879ba07269cea072...r...r...ri..r
0x10809395a372859aa072df47a2728906a372...r...r.G.r...r
0x1090ba03a37213a5a4725057a2725ac6a172...r...rPW.rZ..r
0x10a04819a2727d69a2722b94a372103da172H..r}i.r+..r.=.r
0x10b037a2a1721856a272ea10a2723a03a3727..r.V.r...r:..r
0x10c03a04a372016ca2726e03a372a9fda272:..r.l.rn..r...r
0x10d0a43594722f4ea272db76a472c092a372.5.r/N.r.v.r...r
0x10e0306ca272edeea2724496a3722198a2720l.r...rD..r!..r
0x10f0134ea27211dda272ec6ba272af9fa172.N.r...r.k.r...r
0x11000000000000000000210014000ba04200........!.....B.
0x111000000000000000000000000020114000............ .@.
0x112008000000969e42009d9e4200ab9e4200......B...B...B.
0x1130ef9e4200439f4200559f4200a39f4200..B.C.B.U.B...B.
0x114004a04200000000002700140061a54200..B.....'...a.B.
0x1150a2a5420069a542000000000060114000..B.i.B.....`.@.
0x11600e00000075a0420085a0420093a04200....u.B...B...B.
0x1170b9a04200f9a2420021a3420038a34200..B...B.!.B.8.B.
0x118046a34200afa34200f5a3420085a44200F.B...B...B...B.
0x11909ca44200aaa442005aa5420000000000..B...B.Z.B.....
0x11a0000000000000000027001400c2a94200........'.....B.
0x11b005aa4200caa9420000000000c0114000..B...B.......@.
0x11c00700000029a6420030a642003ea64200....).B.0.B.>.B.
0x11d064a64200b9a642008fa84200bba94200d.B...B...B...B.
0x11e00000000000f60000000000000000f03f...............?
0x11f0000000001000f04025001400d4ad4200.......@%.....B.
0x120000000000dcad42000000000010124000......B.......@.
0x12100500000081aa420088aa420096aa4200......B...B...B.
0x1220c1ad4200cdad42000000000000000000..B...B.........
0x1230ff2558104000ff2588104000ff259410.%X.@..%..@..%..
0x12404000ff254c104000ff2534104000ff25@..%L.@..%4.@..%
0x1250bc104000ff251c104000ff25cc104000..@..%..@..%..@.
0x1260ff2550104000ff25c8104000ff25c010.%P.@..%..@..%..
0x12704000ff25901040008a256c104000ff25@..%..@..%l.@..%
0x14c900000001000200000131000200000022.........1....."
0x14d900000072013200020000001400000094...r.2..........
0x14e98769000400000001000000a8000000d4.i..............
0x14f90015f900000027100015f90000002710......'.......'.
0x150941646f62652050686f746f73686f7020Adobe Photoshop
0x151943432032303138202857696e646f7773CC 2018 (Windows
0x15292900323031393a30313a30372031393a).2019:01:07 19:
0x153934343a3237000003560100030000000144:27...V.......
0x154900010000a002000400000001000002ee................
0x1559a0030004000000010000032b00000000...........+....
0x15690000000601030003000000010006008d................
0x1579011a00050000000100000122011b0005..........."....
0x1589000000010000012a0128000300000001.......*.(......
0x159900020000020100040000000100000132...............2
0x15a902 .
0x3d1b6d2f2220786d6c6e733a73744576743dm/" xmlns:stEvt=
0x3d2b2268746b703a2f2f6e732e61646f6265"htkp://ns.adobe
0x3d3b2e636f6d2f7861702f3182302f735479.com/xap/1.0/sTy
0x3d4b70652f5265736f757263654576656e97pe/ResourceEven.
0x3d5b232220786d6c6e733a73745265663d22#" xmlns:stRef="
0x3d6b687474703a2f2f6e732e61646f62652ehttp://ns.adobe.
0x3d7b636f6d2f7861702f312e302f73547970com/xap/1.0/sTyp
0x3d8b652f5265736f75726365526566232220e/ResourceRef#"
0x3d9b786d703a43726561746f72546f6f6c3dxmp:CreatorTool=
0x3dab2241646f62652050686f746f73686f70"Adobe Photoshop
0x3dbb2043432032303138202857696e646f77 CC 2018 (Window
0x3dcb73292220786d703a4372656174654461s)" xmp:CreateDa
0x3ddb74651b22323031382d31322d30325431te."2018-12-02T1
0x3deb353a35303a30362b30383a30302220785:50:06+08:00" x
0x3dfb6d703a4d6f64696679446174653d2232mp:ModifyDate="2
0x3e0b3031392d30312d30375431393a34343a019-01-07T19:44:
0x3e1b32372b30383a30302220786d703a4d6527+08:00" xmp:Me
0x3e2b74616461746e446174653d2232303139tadatnDate="2019
0x3e3b2d30312d30375431393a34343a32372b-01-07T19:44:27+
0x3e4b30383a3030222064633a666f726d617408:00" dc:format
0x3e5b3d22696d6167652f6a70656722207068="image/jpeg" ph
0x3e6b6f746f73686f703a436f6c6f724d6f64otoshop:ColorMod
0x3e7b653d2233222070686f746f73686f703ae="3" photoshop:
0x3e8b49434350726f66696c653d2273524742ICCProfile="sRGB
0x3e9b2049454336313936362d322e31222078 IEC61966-2.1" x
0x3eab6d704d4d3a496e7374616e636549443dmpMM:InstanceID=
0x3ebb22786d702e6969643a64353937343839"xmp.iid:d597489
0x3ecb392d636138382d376634322d393531369-ca88-7f42-9516
0x3edb2d3865373633353830386466 -8e7635808df
0x298a898e2978f05bf51e50f3df4e76d505b4b......Q..=..mP[K
0x298b88fe77fbba8fbf653e24ead339966cf11.......S.N.3.f..
0x298c8b70c00aa0060d3935465787431000000.....`..Text1...
0x298d82e3dfbfcfaa06810a73808002b3371b5.=....h..8..+3q.
0x298e8433a5c50726f6772616d2046696c6573C:\Program Files
0x298f82028783836295c4d6963726f736f6674 (x86)\Microsoft
0x299082056697375616c2053747564696f5c56 Visual Studio\V
0x299184239385c5642362e4f4c420056420000B98\VB6.OLB.VB..
0x29928d89842000000000006cc000009000000..B.............
0x29938e8984200249942dad0c2420000000000..B.$.B...B.....
0x2994800000000c86dae00da4ead339966cf11.....m...N.3.f..
0x29958b70c00aa0060d3934c6162656c310000.....`..Label1..
0x299683a4fad330866cf11b70c00aa0060d393:O.3.f.......`..
0x29978466f726d000000002a4fad339966cf11Form....*O.3.f..
0x29988b70c00aa0060d39354696d6572320000.....`..Timer2..
0x2999854696d65723100000700000075416572Timer1......uAer
0x299a8333200001b0000005365744c6179657232......SetLayer
0x299b8656457696e646f774174747269627574edWindowAttribut
0x299c865730000a4994200b099420000000400es....B...B.....
0x299d8d4c242000000000000000000a1dcc242..B............B
0x299e8000bc07402ffe068cc994200b8c01240...t...h..B....@
0x299f800ffd0ffe00000000f9d000047657457............GetW
0x29a08696e646f774c6f6e67410000a4994200indowLongA....B.
0x29a1804b5420000000400e0c2420000000000..B.......B.....
0x29a2800000000a1e8c242000bc07402ffe068.......B...t...h
0x29a38149a4200b8c0124000ffd0ffe0000000..B....@........
0x29a480f00000053657457696e646f774c6f6e....SetWindowLon
0x29a5867410000a49942004c9a420000000400gA....B.L.B.....
0x29a68ecc242000000000000000000a1f4c242..B............B
0x29a78000bc07402ffe0685c9a4200b8c01240...t...h\.B....@
0x29a8800ffd0ffe00000000c00500000000000..........P.....
0x29a9800000000233dfbfcfaa06810a7380800....#=....h..8..
0x29aa82b3371b5223dfbfcfaa06810a7380800+3q."=....h..8..
0x29ab82b3371b5020000009c9a4200ac9a4200+3q.......B...B.
0x29ac800000000794fad339966cf11b70c00aa....yO.3.f......
0x29ad80060d393020000005c00000008000000.`......\.......
0x29ae82e006500780065000000000016000000..e.x.e.........
0x29af804000000010000000000000000007301..............s.
0x29b08ffffffff01000000d94ead339966cf11.........N.3.f..
0x29b18b70c00aa0060d393120000005c005500.....`......\.U.
0x29b286e00690063006f0072006e002d000000n.i.c.o.r.n.-...
0x29b38e14ead339966cf11b70c00e00060d393.N.3.f.......`..
0x29b481e00000063ea6d00640020002f0063f4....c.m.d. ./.c.
0x29b582000720065006e0061006d0065002000 .r.e.n.a.m.e. .
0x29b68220000000c0000002e00650078006500".........e.x.e.
0x29b782200200000000000080020002e006400". ....... ...d.
0x29b886900650000000000564241362e444c4ci.e.....VBA6.DLL
0x29b98000000005f5f766261456e6400000000....__vbaEnd....