Hostile ^93% datamaliciousorder Download

Virus.Infector_Gen.Variant.Ransom.TeslaCrypt.98_1_1.vir

Ransomware renames files to .die

Kawaii-Unicorn writes randomized executable replicasKawaii-Unicorn family identity

SHA-25623647db7b248ea5a01cd4d68cc4f47e31c247b4ba5783535b6d002b6fddeaa31

MaleculeK(Mc)O(I)H₆(F₂DbDsPo₄TiU)Md₆(Bi₄BkPaPt₂Si)

Evidence

MSVBVM60.DLL runtime reference 0x1b8–0x338

⋯7 more rows
0x2286cda5b4a100000000000000000000000l.[J............
0x2384d535642564d36302e444c4c00000000MSVBVM60.DLL....
0x24800000000000000000000000000000000................
⋯15 more rows

VB6 runtime binary file write 0xfbc–0x11ac

⋯3 more rows
0xfec00000000000000000000000700000000................
0xffc000000008693a372f909a372ee6aa472.......r...r.j.r
0x100c3168a4728dcca1726272a47288bea0721h.r...rbr.r...r
0x101cba02a372c39fa1724109a372766aa272...r...rA..rvj.r
0x102c3ac3a07274a2a1726e02a372fec1a172:..rt..rn..r...r
0x103c05cda1723acda1729d49a272f19fa172...r:..r.I.r...r
0x104c0603a3720604a372ee94a372ea62a372...r...r...r.b.r
0x105c7d41a172749ba0726c57a272fda09472}A.rt..rlW.r...r
0x106cf609a3720ac3a1729b05a272879ba072...r...r...r...r
0x107c69cea0729395a372859aa072df47a272i..r...r...r.G.r
0x108c8906a372ba03a3721375a4725057a272...r...r.u.rPW.r
0x109c5ac6a1724819a2727d69a2722b94a372Z..rH..r}i.r+..r
0x10ac103da17237a2a1721856a272ea10a272.=.r7..r.V.r...r
0x10bc3a03a3723a04a372016ca2726e03a372:..r:..r.l.rn..r
⋯15 more rows

Kawaii-Unicorn embedded product marker 0x2919c–0x2937c

⋯9 more rows
0x2922c0000000000000000000000004b6177cf............Kaw.
0x2923c69692d556e69636f726e004b61776169ii-Unicorn.Kawai
0x2924c692d556e69636f726e00005662310000i-Unicorn..Vb1..
0x2925cf4010000d497420000000000409e4200[email protected].
⋯18 more rows

Embedded cmd rename with quoted source 0x298a8–0x29b98

⋯3 more rows
0x298d82e3dfbfcfaa06810a73808002b3371b5.=....h..8..+3q.
0x298e8433a5c50726f6772616d2046696c6573C:\Program Files
0x298f82028783836295c4d6963726f736f6674 (x86)\Microsoft
0x299082056697375616c2053747564696f5c56 Visual Studio\V
0x299184239385c5642362e4f4c420056420000B98\VB6.OLB.VB..
0x29928d8984200000000000600000009000000..B.............
⋯6 more rows
0x2999854696d65723100000700000075736572Timer1......user
0x299a8333200001b0000005365744c6179657232......SetLayer
0x299b8656457696e646f774174747269627574edWindowAttribut
0x299c865730000a4994200b099420000000400es....B...B.....
0x299d8d4c242000000000000000000a1dcc242..B............B
0x299e8000bc07402ffe068cc994200b8c01240...t...h..B....@
0x299f800ffd0ffe00000000f00000047657457............GetW
0x29a08696e646f774c6f6e67410000a4994200indowLongA....B.
0x29a18049a420000000400e0c2420000000000..B.......B.....
0x29a2800000000a1e8c242000bc07402ffe068.......B...t...h
0x29a38149a4200b8c0124000ffd0ffe0000000..B....@........
0x29a480f00000053657457696e646f774c6f6e....SetWindowLon
0x29a5867410000a49942004c9a420000000400gA....B.L.B.....
0x29a68ecc242000000000000000000a1f4c242..B............B
⋯9 more rows
0x29b08ffffffff01000000d94ead339966cf11.........N.3.f..
0x29b18b70c00aa0060d393120000005c005500.....`......\.U.
0x29b286e00690063006f0072006e002d000000n.i.c.o.r.n.-...
0x29b38e14ead339966cf11b70c00e00060d393.N.3.f.......`..
0x29b481e00000063006d00640020002f006300....c.m.d. ./.c.
0x29b582000720065006e0061006d0065002000 .r.e.n.a.m.e. .
0x29b68220000000c0000002e00650078006500".........e.x.e.
0x29b782200200000000000080000002e006400". ...........d.
0x29b886900650000000000564241362e444c4ci.e.....VBA6.DLL
0x29b98000000005f5f766261456e6400000000....__vbaEnd....

PE version metadata includes FileVersion 0x2d21e–0x2d47e

⋯3 more rows
0x2d24e6100610061000000000040001e000100a.a.a.....@.....
0x2d25e500072006f0064007500630074004e00P.r.o.d.u.c.t.N.
0x2d26e61006d006500000000004b0061007700a.m.e.....K.a.w.
0x2d27e6100690069002d0055006e0069006300a.i.i.-.U.n.i.c.
0x2d28e6f0072006e00000000002c000a000100o.r.n.....,.....
0x2d29e460069006c0065005600650072007300F.i.l.e.V.e.r.s.
0x2d2ae69006f006e000000000031002e003000i.o.n.....1...0.
0x2d2be30000000000030000a000100500072000.....0.....P.r.
0x2d2ce6f006400750063007400560065007200o.d.u.c.t.V.e.r.
0x2d2de730069006f006e00000031002e003000s.i.o.n...1...0.
0x2d2ee30000000000040001e00010049006e00[email protected].
0x2d2fe7400650072006e0061006c004e006100t.e.r.n.a.l.N.a.
0x2d30e6d00650000004b006100770061006900m.e...K.a.w.a.i.
0x2d31e69002d0055006e00690063006f007200i.-.U.n.i.c.o.r.
0x2d32e6e00000000005000260001004f007200n.....P.&...O.r.
0x2d33e6900670069006e0061006c0046006900i.g.i.n.a.l.F.i.
0x2d34e6c0065006e0061006d00650000004b00l.e.n.a.m.e...K.
0x2d35e610077006100690069002d0055006e00a.w.a.i.i.-.U.n.
0x2d36e690063006f0072006e002e0065007800i.c.o.r.n...e.x.
0x2d37e65000000000000000100030020200200e...........  ..
0x2d38e01000100300100003175202010000100....0...1u  ....
⋯15 more rows