fcb020fc827bf432792feef13068e8094ae0dd1f201fa398a360eecf6216630b.exe

BENIGN

Mal-ecule

Size 152.0 KB download

First seen 85 days ago

Analyzed 67 days ago

Well-known

malware/trojan/shellobject user32 dynamic dispatch target

anti-static/obfuscation Huge null run in executable (128+ bytes)

anti-static/obfuscation/binary-metrics Binary has normal code entropy (>5.5)

anti-static/obfuscation/payload PE version resource text

anti-static/obfuscation/string Long mixed-case identifiers cluster

command-and-control/dropper VB6 runtime dispatch string cluster

command-and-control/infrastructure Binary has 4 or fewer sections

evasion/masquerade PE lacks VS_VERSION_INFO resource

evasion/masquerade/file Filename has EXE extension

impact/destroy Preserves .exe .gho .bak files

data/encode Repeated 64-char uppercase hex blocks

dylib VB6 DllFunctionCall thunk

communications/proxy SOCKS5 client greeting bytes

mem/protect VirtualAlloc API string reference

build PE carries bound import descriptors

binary VB6 runtime helper import

dylib::msvbvm60 links msvbvm60 (ORDINAL 583, CIcos, adj_fptan, vbaVarMove, ORDINAL 587, ... +55 more)

package PE ProductName metadata field

binary/metrics Binary has 40+ imports

binary/section PE standard code/data section

20 of 23 traits shown

SHA-256	fcb020fc827bf432792feef13068e8094ae0dd1f201fa398a360eecf6216630b
Filename	fcb020fc827bf432792feef13068e8094ae0dd1f201fa398a360eecf6216630b.exe

Source	harvest

Not seeing what you expected? Let us know