Benign pe-machine-learning-dataset Download

513991

VB6 runtime API dispatchVB6 DllFunctionCall thunk

SHA-25675430b8cd13f3974be5950f0a84bcf23b31d4199c17e729e804d9dddffbc8b3a

Evidence

VB6 runtime DLL string 0x238–0x268

0x2386cda5b4a100000000000000000000000l.[J............
0x2484d535642564d36302e444c4c00000000MSVBVM60.DLL....
0x25800000000000000000000000000000000................
0x268000000000000000000000000        ............    

VB6 DllFunctionCall thunk 0x1084–0x1134

0x1084b97da2722f70a272ea62a3727d41a172.}.r/p.r.b.r}A.r
0x1094749ba07210c4a172de56a272aec6a172t..r...r.V.r...r
0x10a4f697a472a9a1a172fda0947205cba172...r...r...r...r
0x10b4c78da472f609a372879ba072dc19a272...r...r...r...r
0x10c49395a372c896a172859aa072d404a272...r...r...r...r
0x10d4df47a272db7da372583ca172a350a172.G.r.}.rX<.r.P.r
0x10e48906a372ba03a372560fa272895ca172...r...rV..r.\.r
0x10f41375a472e98fa2724819a2727d69a272.u.r...rH..r}i.r
⋯4 more rows

PE version resource structure 0x8126–0x8156

0x81260000b004000000000000bc0634000000............4...
0x8136560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x81464f004e005f0049004e0046004f000000O.N._.I.N.F.O...
0x81560000bd04effe0000010008000300a2  ............... 

PE FileVersion metadata field 0x86d2–0x87f2

0x86d22e002e002e00000000002c000a000100..........,.....
0x86e2500072006f0064007500630074004e00P.r.o.d.u.c.t.N.
0x86f261006d006500000000006d0045005400a.m.e.....m.E.T.
0x87024f000000000034001400010046006900O.....4.....F.i.
0x87126c006500560065007200730069006f00l.e.V.e.r.s.i.o.
0x87226e000000000033002e00300038002e00n.....3...0.8...
0x8732300039003300300000003800140001000.9.3.0...8.....
0x8742500072006f0064007500630074005600P.r.o.d.u.c.t.V.
0x875265007200730069006f006e0000003300e.r.s.i.o.n...3.
⋯6 more rows
0x87c26c0065006e0061006d00650000004d00l.e.n.a.m.e...M.
0x87d2650063006c00650061006e0055002e00e.c.l.e.a.n.U...
0x87e265007800650000000000000001000100e.x.e...........
0x87f240400000010008002816            @@......(.      