Sample details: 106d19dac7dcfca8c4f5234e2b4ff97f --

Hashes
MD5: 106d19dac7dcfca8c4f5234e2b4ff97f
SHA1: e8f30d5e6a9a5fd53eec2526d366fc5fe5cecf81
SHA256: 2dae150470a115b24aa1f36eba501ecdd6b0ebf0f5406bcd0603958d8459fc4c
SSDEEP: 6144:NP+JkVJxu+hl0avHiXko7gRS+ifzHOLjvyAmJkED9mPF5qPCWDVBGPdEGDobfW:gGToq0GHiXkxRSLOL+hDM95ECWJb
Details
File Type: PE32
Yara Hits
YRP/Microsoft_Visual_Basic_v50v60 | YRP/Microsoft_Visual_Basic_v50 | YRP/Microsoft_Visual_Basic_v50_v60 | YRP/Microsoft_Visual_Basic_v50_additional | YRP/Microsoft_Visual_Basic_v50v60_additional | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/HasRichSignature | YRP/domain | YRP/contentis_base64 | YRP/SEH__vba |
Source
http://kikkerdoc.com/images/ubber.exe
http://kikkerdoc.com/images/ubber.exe
Strings
		!This program cannot be run in DOS mode.
`.data
MSVBVM60.DLL
Interceded0
VB5!6&*
Schoberova7
Cecidologist5
Interceded0
Shorting
Endorsee6
Interceded0
C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Label1
Check1
KERNEL32.DLL
EnumUILanguagesA
user32
GetClassNameA
FindWindowA
ShowWindow
PostMessageA
comdlg32.dll
ChooseColorA
VBA6.DLL
__vbaErrorOverflow
__vbaI4Var
__vbaInStrB
__vbaNew2
__vbaVarSetObjAddref
__vbaVarTstNe
__vbaVarMove
__vbaFreeStrList
__vbaVarDup
__vbaStrToUnicode
__vbaSetSystemError
__vbaStrToAnsi
__vbaVarAdd
__vbaStrVarMove
__vbaStrMove
__vbaFreeVarList
__vbaEnd
__vbaFreeVar
__vbaVarTstEq
__vbaFreeStr
__vbaStrCopy
__vbaStrCmp
Shorting
Capsaicin5
{pV.C3Z
]3xk<&f
xDxvn6
L^l$y!
L}`TKg
 FG0"/3T
l-M=9<
-]G" >
)3h+CfB^
li1Xkr
>w?eA'
B`Oov(p
H#Vp$Z
mL:1~m
(D<<(S
zj(cR{|
\ cRWN
L6VzY@
)hehp)
g#TL~wl
o/kceC
;XRc_w
]4)Q []
j^[c<,
6{r8A>tir
lh iiR
SKKs)(
J*h~[DA
L0N{A6D
7[qO?Vf
d&@uHVzbK
MXPQ;Q
fXvEb(
TB}5(R"#
{#_Z^*
sdf{6G
G`TT<ZQ&
-HisZG
rXTQa,>d
!U61}B_''
)pU3}5W]
d94$q 
-BB'"X
5m./`R
{~v_v) >
!j_hNmH
b,eo$D
v\	Q{4
7z8:jw^
U%)ebW
n{xvX^
'o@mu-
gx?/B@
lV'AF>
vAe~P7
$	o^K"
%>F@^h
%AO@r	
j`SX~]
$M>WEc
DznhP>/
_qULvj9
QBvS[<
^&L>m5
HJm#J;
zk>{jk9
s]Jg:]+
9n`l#c
hhp#\7
zTvj^J
RX/y32x
t	D{6G
oHmy-E3
v]XGgu
1tqdrg@
.DIy_W
eqwfgv
lh;xJB
\zrQc>
F|.`.@
QOCcJ2O;
hhp#_?
dGtrsq
)3j#3{ <
jUcR{|I1
-x.`.@
-AMok$
D3PzP~
B-)p]1
+8]GuC
}T*a6G`kD
vk_1Xk&
tqwg/vi
"B p;8
^%a3gn)
*	U0t/
Y[cJ^8
:|&	Q=
mAmW7x
S4p%?2/
fu/(y	
[r	YX<
v4Ym^8
;iHNzc
xk=oh#
UR{|I1(
p5z|@p|
vZk2x3]
;j	%[W
veRNuF
oF[PLS
t.\Vo@
""d)E}
0_qx&Vl
Uxggnb
HMjhp#_
sj.HIa
Df*DC>Wy
usry	%
NPxyjrVX
S3^}b`W
	'"}vOz
$73H37
?tr	Q=$
up"h,9
#$qqna
KuN<.`R
B-][=#
Ib0Q:6f
g#TL~wl
\ZAAsg
ubN\\=
?r(#J2
c&M!B}
OCcj3r
Sb p_4
h8;TK-)TO
3D>/	'w
5vE=b:
ZOXBI{[
&Q^~RP<
6GoZ`!
ay,X%\
KF4|$uc
sADF6A
{8DO>x
d1'RwN
~&4_%t
{=fJ?h
dd'N'a
y'2W8c
2y%6N%b
[d1%Vwk
c63]#b
	v0)Lp
RKmWP:
{7Df>w
x47L$y
}{+dQy
DF>w%j
7~&4_%t
8b64[9y
xF1#L.]
svz#7(
%Pby}[s
OZug~<d
' 1ebX@
R%hQO/
:M:S`W/X
]b]TL8x
B&Y(HlQ
B"33i8<
L(*oz`
}5[>t6m
F}SvjJ
LBb`V+
;5Hc N-
M_{Wooc
 pGH58CwO
7be#Sg[
>C[2Jq
E%nmap
.CXbVq
T2&8la
5DBQ>1
iY9Ov;]
:`{4go
\QV+U5
q}Z?pO,
g1My2^c
NR<cxj
C9%D=d
$3@I!?
SHB4a7
UHZczw
Hu[;cu
8lgiPu
9_G>xu
NeqBLW
h?vP/*
,Sf%~+!6
$I&Fr\
\dAs+B
A,c@BI
W';kN%
A:uE|'
U@z9'\
h[a0':QH
@J`K^.5-
w%Ln091
/2;t^$
y.;A1$Y
/g~-mq
$k-,6.
^Y8c(T2{
_[gxT(.Jm{
yp<M-S 
6d0I[W#
kCcv?6k"
fia\F>
3Uwl!-bE
 ]*ag@Q
$zlq,0
wIik"791
ho{k?^
\EmEWx
)T?Kc1:l
	Pm5\HHSm
vTF2q.
01gEu[
fUk2Fr
} N4fEj
M!XodA
+[G-n F
DW\3d|J
Mu:ym:
ds ?`~
cyF	y\p
U{I=BB
u>U"dU9Z,#
ZqiJyf;*
46L8l]uJ
%!mc"3
w^Yl!3
dtI$Va}
WvcYTTpLq
g-\y\H
=1x^w<
egfFN6
eOu4iF
ao&um>NS82
zpz~7R
e_Oka~
c>{op~
*0aDS9
xgB5<W
>fQ9aq^jz,
pmO_'gJB
_[tRKF
/mC#~'
?ff?Ei
Dp'`W3
RA:Aud5DD
jL75P 
8=]UzL
%8ve?=
8XN62| 
	ffA}:
"HW;zr
o.?*zh5
V~DxXB=
-RCfU2fc
p]{lw8
Z K/)k
(Bu.gq
+x278c
,xgw1I
XoQo_\
uHFPw(XxU
mXB<d*
3b|W@L
"#=hLa
sKowiN?3
aN6&sUrf2
V(mq7U
YEDwy U
[mSj	3|
vQi4[N
a0vy?hkD
NY?<myp
Hy dg .3
,#j	(<l-
%>9JA8
($A-(x
$aV+~+
of9E^c
:ly=Y[
z7V94*
N2|BS1
)"*x3}
o~o.W]w
O q^1I
qSC@Wb
f56/MC
Uui1H|ak
MaXPx(
@=2L,w
RJ9PP%&
{hN'a@
^wMl;A^
x8#LHl/
,&';VI
x>om4u
`f~55G*
<H7pJ%=
<w,C)U
l,pn)\m
bxPsYU,
&$]98H
9:ei7Y
o~m`C!
rS|IZM
OLWCox
~FPyF>e
R7vAl_
Y]	i'^R
Ei@EF 
6#><&cN$
B~5Dud
lkVx0I[
kz%2Ou
$l#2y1
V`2;TR/"
9*"$_u
ZFxck"
Q{/2j4EWu
> ,og@
Cbk6e-{4
swGOSL
8o0^J(M
?;*Nie
rNk/F>
4 x`ITn
D	lhWI
J/~7{c
hCu4!B
1tMo:,
my;ts]
v~	28m
Y6U9|9
Ud#Pz-/
>DuX{n
`;"VPf^}
xh]zmI
,Eet5:[-/u~]
)qmG@|
:C)5(3
P,%VAw
g=4/_X
hr3o`(0
!?.(_V
>1|{r%.
xk;wCX/|
zs8JgM
9L90lw
Yf|]{G
UfbHhN
L_&*!g
ELM6L5Q
8p]}IN
1-~#,C
rt@Z@Y
4&7&R&
7)'X8o
qWt.!&
1;HmF;
mq?hqo}
xtMrRQU
]3d.tdUt
iKDtqO*6
U>7,?>
SP/eL2
RG14o^QK
5,#-h(4
 H>I9K
3l(p5R
%'55sF
}*{&~G
8Lpm,#
eD\Dk{
j8WM(<
p,hQe;
y/{XHR{
deU3ySN
l`xTN9
3 fJ{H
'2iY\1x
T+D%S;
K(@9u	
73c<r.?s\
tsI+6jn
Fx,9[{
MNYx\h4
g;Pt5}{u
A~-p=6
{Xi+7Q
O	S%3f	'W
Yd8aNU
Waa	B1
"J}df+~
NZE$H}
bNgz y>
kb"n'E
>YyU*\
X7K &N
&*iArf7i8
\)FN_(h
O{(Z_9V'1"
d#Mo/<6
-r65W8c
ZKI2ZKI2fonN~
]CA=<<=>>B\^
B:658<AD^`pbaa`^DB?A
5<Dbq}}}qponopqxyyqaD@=\
:aC;9?
yxpnba`bcpy
xbB<;C
}x!ba_acpy}oC9;
xob__aoy}oA7>
}qc`_aoy}b;7\
T4.-1Lfz
xc__bp
}qb_hcy
								
}n`_bx
										
											
											h#N
qa^`x}\
								
q`^ayy=5
										)	
}b__p}>
p__a}ap=
}a__pq7
					)*l
n__cy>
q_^ayD
y`__x^
s"				
}a__q`
}a__p`
}!__p^
}a^_qD
ya^`q?
x`_aq9
}cabp:
nabo=h
ycab)8
(LJ&N~
}naac>
W(+GR3"Gv
|jUF)'Mu
yoaab?
{R4Oi~
)xnab`<
ypbab\7
pcbb`>
}xpccnaA5
A58Bny
)xpnnon`?5
75<\nx
}yxxqqpqpobC:
<559?\aoqyyyyhxx
pn`\>7
;<>==;96
DB>):86799;AC^`
wwwlll
nnnbbb
aaaxxx
iiiggg
ddd~~~
qqqnnn
vvvkkk
mmmqqq
rrrhhh
qqqeee
dddkkk
uuuiii
5}}hhhbbbsss
|||iii
ccciii
___oooF
gggeee
vvv|||
Capsaicin5
Check1
Check1
Label1
Label1
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
_adj_fprem1
__vbaSetSystemError
_adj_fdiv_m32
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
__vbaVarTstEq
DllFunctionCall
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
__vbaErrorOverflow
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaVarAdd
__vbaInStrB
__vbaStrToAnsi
__vbaVarDup
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeStr
|||iii
ccciii
___oooF
gggeee
vvv|||
wwwlll
nnnbbb
aaaxxx
iiiggg
ddd~~~
qqqnnn
vvvkkk
mmmqqq
rrrhhh
qqqeee
dddkkk
uuuiii
5}}hhhbbbsss
]CA=<<=>>B\^
B:658<AD^`pbaa`^DB?A
5<Dbq}}}qponopqxyyqaD@=\
:aC;9?
yxpnba`bcpy
xbB<;C
}x!ba_acpy}oC9;
xob__aoy}oA7>
}qc`_aoy}b;7\
T4.-1Lfz
xc__bp
}qb_hcy
								
}n`_bx
										
											
											h#N
qa^`x}\
								
q`^ayy=5
										)	
}b__p}>
p__a}ap=
}a__pq7
					)*l
n__cy>
q_^ayD
y`__x^
s"				
}a__q`
}a__p`
}!__p^
}a^_qD
ya^`q?
x`_aq9
}cabp:
nabo=h
ycab)8
(LJ&N~
}naac>
W(+GR3"Gv
|jUF)'Mu
yoaab?
{R4Oi~
)xnab`<
ypbab\7
pcbb`>
}xpccnaA5
A58Bny
)xpnnon`?5
75<\nx
}yxxqqpqpobC:
<559?\aoqyyyyhxx
pn`\>7
;<>==;96
DB>):86799;AC^`