af504337b51f5fb5bcc3c779afc95bf5b167431660ebd8b71fcfdff1ec9e227a.exe

BENIGN

Mal-ecule

Size 536.0 KB download

First seen 85 days ago

Analyzed 66 days ago

Objectives

anti-static/obfuscation Huge null run in executable (128+ bytes)

anti-static/obfuscation/payload PE version resource text

command-and-control/dropper VB6 runtime dispatch string cluster

command-and-control/infrastructure Binary has 4 or fewer sections

evasion/masquerade/file Filename has EXE extension

impact/destroy Preserves .exe .gho .bak files

persistence/login/scheduled-task Regex component marker

persistence/system/registry Executable path in TypeLib redirection

data/encode Large hexadecimal encoded blob

dylib VB6 DllFunctionCall thunk

fs/file/write VB6 runtime file open helper

communications/proxy SOCKS5 client greeting bytes

data/string VB6 __vbaVarCat string concatenation

build PE carries bound import descriptors

binary PE has RT_ICON in resources list

binary/metrics High number of imported symbols (>80)

dylib::msvbvm60 links msvbvm60 (EVENT_SINK_GetIDsOfNames, CIcos, adj_fptan, vbaVarMove, vbaStrI4, ... +77 more)

package Large binary with few DLL dependencies

binary/anomaly PE version info numeric fields present

binary/section PE standard code/data section

20 of 26 traits shown

SHA-256	af504337b51f5fb5bcc3c779afc95bf5b167431660ebd8b71fcfdff1ec9e227a
Filename	af504337b51f5fb5bcc3c779afc95bf5b167431660ebd8b71fcfdff1ec9e227a.exe

Source	harvest

Not seeing what you expected? Let us know