Hostile ^92% Download

7b34fdcc7f57d45abbf410fe1ca613d7cacabbb30e2f0db67bb6debf3f61abdd

Kawaii-Unicorn writes randomized executable replicasKawaii-Unicorn family identity

SHA-2567b34fdcc7f57d45abbf410fe1ca613d7cacabbb30e2f0db67bb6debf3f61abdd

URLhttps://tria.ge/api/v0/samples/260911-rnns9sgj2y/sample

MaleculeK(Mc)O(I)H₆(F₂DbDsPo₄TiU)Md₆(Bi₄BkPaPt₂Si)

Evidence

MSVBVM60.DLL runtime reference 0x1b8–0x338

⋯7 more rows
0x2286cda5b4a100000000000000000003800l.[J..........8.
0x2384d535642564d36302e444c4c00000000MSVBVM60.DLL....
0x24800000000000000000000000000000000................
⋯15 more rows

VB6 runtime binary file write 0xfa0–0x11c0

⋯5 more rows
0xff000000000000000000000000000000000................
0x10008693a372f909a372ee6aa4723168a472...r...r.j.r1h.r
0x10108dcca1726272a47288bea072ba02a372...rbr.r...r...r
0x1020c39fa1724109a372766aa2723ac3a072...rA..rvj.r:..r
0x103074a2a1726e02a372fec1a17205cda172t..rn..r...r...r
0x10403acda1729d49a272f19fa1720603a372:..r.I.r...r...r
0x10500604a372ee94a372ea62a3727d41a172...r...r.b.r}A.r
0x1060749ba07210c4a1726c57a272fda09472t..r...rlW.r...r
0x1070f609a3720ac3a1729b05a272879ba072...r...r...r...r
0x108069cea072dc19a2729395a372859aa072i..r...r...r...r
0x1090df47a2728906a372ba03a3721375a472.G.r...r...r.u.r
0x10a05057a2725ac6a1724819a2727d69a272PW.rZ..rH..r}i.r
0x10b02b94a37267e8a072103da17237a2a172+..rg..r.=.r7..r
0x10c01856a272ea10a2723a03a3723a04a372.V.r...r:..r:..r
0x10d0016ca2726e03a372a9fda272a4359472.l.rn..r...r.5.r
⋯15 more rows

Kawaii-Unicorn embedded product marker 0x291c0–0x293a0

⋯8 more rows
0x2924087000000960000009700000000000000................
0x292500000000000e90000000000004b617761............Kawa
0x2926069692d556e69636f726e004b61776169ii-Unicorn.Kawai
0x29270692d556e69636f726e00005662310000i-Unicorn..Vb1..
⋯19 more rows

Embedded cmd rename with quoted source 0x298d0–0x29bc0

⋯3 more rows
0x299002e3dfbfcfaa06810a73808002b3371b5.=....h..8..+3q.
0x29910433a5c50726f6772616d2046696c6573C:\Program Files
0x299202028783836295c4d6963726f736f6674 (x86)\Microsoft
0x299302056697375616c2053747564696f5c56 Visual Studio\V
0x299404239385c5642362e4f4c420056420000B98\VB6.OLB.VB..
0x2995000994200000000000600000009000000..B.............
⋯6 more rows
0x299c054696d65723100000700000075736572Timer1......user
0x299d0333200001b0000005365744c6179657232......SetLayer
0x299e0656457696e646f774174747269627574edWindowAttribut
0x299f065730000cc994200d899420000000400es....B...B.....
0x29a00d4c242000000000000000000a1dcc242..B............B
0x29a10000bc07402ffe068f4994200b8d01240...t...h..B....@
0x29a2000ffd0ffe00000000f00000047657457............GetW
0x29a30696e646f774c6f6e67410000cc994200indowLongA....B.
0x29a402c9a420000000400e0c2420000000000,.B.......B.....
0x29a5000000000a1e8c242000bc07402ffe068.......B...t...h
0x29a603c9a4200b8d0124000ffd0ffe0000000<.B....@........
0x29a700f00000053657457696e646f774c6f6e....SetWindowLon
0x29a8067410000cc994200749a420000000400gA....B.t.B.....
0x29a90ecc242000000000000000000a1f4c242..B............B
⋯9 more rows
0x29b30ffffffff01000000d94ead339966cf11.........N.3.f..
0x29b40b70c00aa0060d393120000005c005500.....`......\.U.
0x29b506e00690063006f0072006e002d000000n.i.c.o.r.n.-...
0x29b60e14ead339966cf11b70c00aa0060d393.N.3.f.......`..
0x29b705f5f766261467265655374724c697374__vbaFreeStrList
0x29b80000000001e00000063006d0064002000........c.m.d. .
0x29b902f0063002000720065006e0061006d00/.c. .r.e.n.a.m.
0x29ba065002000220000000c0000002e006500e. .".........e.
0x29bb078006500220020000000000008000000x.e.". .........
0x29bc02e006400690065000000000056424136..d.i.e.....VBA6

PE version metadata includes CompanyName 0x7479a–0x74a8a

0x7479affffffffffffffffffffffffffffffff................
0x747aaffffffffffff00000100010000150000................
0x747ba01002000c87604000100340234000000.. ..v....4.4...
0x747ca560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x747da4f004e005f0049004e0046004f000000O.N._.I.N.F.O...
⋯6 more rows
0x7484a300038003000340030003400420030000.8.0.4.0.4.B.0.
0x7485a00002c000a00010043006f006d007000..,.....C.o.m.p.
0x7486a61006e0079004e0061006d0065000000a.n.y.N.a.m.e...
0x7487a00005500450046004900000000004000..U.E.F.I.....@.
⋯3 more rows
0x748ba690063006f0072006e00000000002c00i.c.o.r.n.....,.
0x748ca0a000100460069006c00650056006500....F.i.l.e.V.e.
0x748da7200730069006f006e00000000003100r.s.i.o.n.....1.
0x748ea2e00300030000000000030000a000100..0.0.....0.....
0x748fa500072006f0064007500630074005600P.r.o.d.u.c.t.V.
0x7490a65007200730069006f006e0000003100e.r.s.i.o.n...1.
0x7491a2e00300030000000000040001e000100..0.0.....@.....
0x7492a49006e007400650072006e0061006c00I.n.t.e.r.n.a.l.
0x7493a4e0061006d00650000004b0061007700N.a.m.e...K.a.w.
⋯3 more rows
0x7497a460069006c0065006e0061006d006500F.i.l.e.n.a.m.e.
0x7498a00004b00610077006100690069002d00..K.a.w.a.i.i.-.
0x7499a55006e00690063006f0072006e002e00U.n.i.c.o.r.n...
0x749aa65007800650000000000440000000000e.x.e.....D.....
⋯14 more rows