Suspicious ^80% Download

Trojan.Win32.VB.egp

Trojan with embedded PE

VB6 concealed API dispatch with transformed stringsVB6 concealed Win32 API dispatch

SHA-25626e2e558dad6745f1446b619530d6131df34cff5832e4ec95d304e4915397abe

MaleculeO(Er)

Evidence

MZ DOS signature validation string 0x234c–0x246c

⋯5 more rows
0x239c0c003c0100000000000000002e000000..<.............
0x23ac4d005a0020007300690067006e006100M.Z. .s.i.g.n.a.
0x23bc740075007200650020006e006f007400t.u.r.e. .n.o.t.
⋯11 more rows

Embedded PE binary at file offset 0x6960 (~40960 bytes) 0x6920–0x69f0

⋯3 more rows
0x6950ffffffffffffffffffffffffffffffff................
0x69604d5a90000300000004000000ffff0000MZ..............
0x6970b8000000000000004000000000000000........@.......
0x698000000000000000000000000000000000................
⋯7 more rows

MZ DOS signature validation string Trojan.Win32.VB.egp · 0x234c–0x246c

⋯5 more rows
0x239c0c003c0100000000000000002e000000..<.............
0x23ac4d005a0020007300690067006e006100M.Z. .s.i.g.n.a.
0x23bc740075007200650020006e006f007400t.u.r.e. .n.o.t.
⋯11 more rows

MSVBVM60.DLL runtime reference embedded:pe:PELoader.exe@0x6960 · 0x1e8–0x308

⋯5 more rows
0x238eccf3a40100000000000000000000000..:@............
0x2484d535642564d36302e444c4c00000000MSVBVM60.DLL....
0x25800000000000000000000000000000000................
⋯11 more rows

VB6 runtime binary file write embedded:pe:PELoader.exe@0x6960 · 0xfe0–0x1150

⋯9 more rows
0x10706a570f66f73c0d6668720e66d1b80d66jW.f.<.fhr.f...f
0x1080a24b0e66304c0e6619a0006676fe0e66.K.f0L.f...fv..f
0x1090cbb70d6611ad0d66443b10668e0e0e66...f...fD;.f...f
0x10a0138a0f66a43c0e665b720f663dbe0c66...f.<.f[r.f=..f
0x10b009fb0e663af80e6608040e6653751066...f:..f...fSu.f
0x10c0fa0d0e66415e0e66ab880f66eee30c66...fA^.f...f...f
0x10d08a380d66ef3d0d661d3c1066af9c0d66.8.f.=.f.<.f...f
0x10e0dc4a0e66baf70e66baf80e660e610e66.J.f...f...f.a.f
⋯7 more rows

Small executable with loader-style filename embedded:pe:PELoader.exe@0x6960 · 0x197c–0x1acc

⋯7 more rows
0x19ec00ffd0ffe00000000c00080000000000................
0x19fc000000001a0000005c00500045004c00........\.P.E.L.
0x1a0c6f0061006400650072002e0065007800o.a.d.e.r...e.x.
0x1a1c650000000c0000004300550053005400e.......C.U.S.T.
⋯11 more rows

VB6 runtime helper import symbol embedded:pe:PELoader.exe@0xba10 · 0xfd0–0x1250

⋯4 more rows
0x1010eef60e6686f70e6686f80e666e890f66...f...f...fn..f
0x10206a570f66949a0c6676fe0e66a79a0c66jW.f...fv..f...f
0x1030138a0f66a5990c66a43c0e6609fb0e66...f...f.<.f...f
0x10403af80e6653751066ab880f66baf70e66:..fSu.f...f...f
0x1050baf80e66eef70e6629f20e667c350066...f...f)..f|5.f
⋯32 more rows