Sample details: 1da95aaac91e7386ef7efb28e52285ea --

Hashes
MD5: 1da95aaac91e7386ef7efb28e52285ea
SHA1: ce7802dabd698e5d8cfe95d6b46d030f982e4eea
SHA256: 67c6c62d202b2b6a76603deaf61652cca90b2d9b17b97ee99d4b2a2948f3c0ae
SSDEEP: 3072:XfIjgaBEhOU6kOhw7fdNXQMlbr70XxaCBdsyhMuzeiAIIOlWAq3/UfiaiDFeaIkB:QjgaB/U63MNllL0cCBdn73GcAPafqJo
Details
File Type: PE32
Yara Hits
YRP/Microsoft_Visual_Basic_v50v60 | YRP/Microsoft_Visual_Basic_v50 | YRP/Microsoft_Visual_Basic_v50_v60 | YRP/Microsoft_Visual_Basic_v50_additional | YRP/Microsoft_Visual_Basic_v50v60_additional | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/HasRichSignature | YRP/domain | YRP/contentis_base64 | YRP/SEH__vba |
Source
http://gtrtooloo.com/00045.exe
http://gtrtooloo.com/00045.exe
Strings
		!This program cannot be run in DOS mode.
`.data
MSVBVM60.DLL
Hebbronville7
Frontsman
Punctated
Punctated
Villaggio
Irregulated1
Aureately3
Infortune0
Tenurially1
Roysecity2
Maquiritari7
Nambiquaran
Phyllogenous
Espringal
VB5!6&*
Birnbaum7
Jalalabad
Hebbronville7
Hebbronville7
Frontsman
Aquamarines
Basari3
Aureately3
C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Irregulated1
Infortune0
Maquiritari7
Phyllogenous
Villaggio
Roysecity2
kernel32
RtlMoveMemory
Powrprof
GetPwrCapabilities
kernel32.dll
EnumUILanguagesA
advapi32.dll
LookupAccountNameA
mesomerism4.dll
Marka0
Basari3
Vilest4
Vilest4
Aquamarines
Bootdisk8
w=9kdscsmsosbsbsksis`s
s`shsjsksjshs}smsksbslslsfsjskslsesms`scsismsdsismsisesjsjs}s}sdscs
sgs~sfs
sjsgsksjsosfsisasgscsas`s|skshs`s`s|sis}ses
sdsbs}sms|sesgsgsgsdskslsks~sislsisgsdsis~sfs}scsesisasesfscs
sdsdshsosds}sjsgsmsgsjsksasesdsis`scslsds}slsoskshsbsososksfshs
sjses|shsjs}sbsasasas~sesfsesmsfsfscsas~scsmsfshs}sbscslsbs`s}sjses~sbsis
shsksasgsasdseslsbs~scsos}sfs~shsmslshsbs|sislshs`sbsjsks
 :MO?2
7}f/#+
aroo1ng*XM
J{uiI)
V[J{uYI)
YmmPh,
YIIj[[
SlOauT
7Lu3^B
#*9SB)lf
iL@{'3
ykD/7s
_1d2Y{
b`Aw{h
o}"b<b
dOmAUV^
Wq|tkR
<_orrSH
( >]`!
M(eq "
4Wbz=*
`*XNwT'
x%S2{8<
'`79jz
"cM%AW}
=ZB[!:
9M|hY:RR
0](m+k
x{1q	9aa_/)F
Vns$*`
f`]`f*X
X Ae!|WY
p?16BL
gh:#ft
3~.a3W
|8=@`qj
`J{\IcO
5?<mYy
YpC{'3
h%,8NRaq
'*!:l$
tI{TJcB
Y9M|e,
[Q6;_$
P{}v$*
J{um?y
PCO2F-
x&}AK=
sWI2DM
_1d2Yl([
O^BWio
d](AUV^
;{pP'*
J{u5I)
'`79jz
wv"OQeE
S{'0\8
J{u	I)
R=iL],se
{uiIIv[;
=NV_$L5Qb
Y"Mf?3i
r~	XMiI
Kor.SH
<3pVL?
FgPiBd
v07]K,
\(N9,>
z}(~=b
?ZR6~z
~srmR{
|orzSH
( n]`!
./Wpw{
%a1vei 
QGkX$ADM
1K{uE=
-8A^zE
PJ=.,@
/ku%2P
/7b%2P
jX%s7M
ha",Pf
&.iLm*
n/&.idm
)&Z"_h=
\2"p*4
3DexK|
X?;oR9
MAsG=k=
MAsGMj=
a'`79jz
mmPoiq
q	9aa_
~o0ff*X
	mmPh$
e])N{r
_{Z!"O
Kor~SH
C'BS t
=b5ET~
qYEv4Vb,
?Z[Miz
a:~9?5
aDkXFK
5r6fg@
1mmPh$
f`\`C*XNwd
ipC{'?
?ZR9NI
?Z[Z(kP9
D=h>tmA
NV9dY	
M	'`79jz
&KgfMP
/m=%2PGv3
'*"n&"
q\N7uq
))8YCk
.y	MA=	
e9M|e,
#FX >K
	O"}\ZY3;
r*XNwP
|orjSH
(mYvOY
}(m-c_T
3~	8iH&?KK=
mmPn,)
Opj&qm
v\7]K+
Y9M|c$2x>}>3
1;M|c,6
3vv	]?
+,oc$!X
=ZB[!:
aL+*CzK
xH-Cz6
CK!wQ3
DsW!\c
tnxZJJW
hG<ZS8
(bS0eq:?
9{jt/|{o
t|dZJ<K
8CO%AR
5mh4GBdn
/CK4sc?
cBYK$u:9
/wk4@Adn
(l}4GWi
m3O3@M[Js?
/jl+sc)#
c<?K$u:9
2dO3U(
CYK$v7&
CYK$v7&
GZK$t3+
5w|4DW(>
5w|4DW(>
_;%YVI
	Vt8Lin}q,
i9G?ODq
~ba:'`
i>2INY
w=9kw=9koFJ[dscsmsosbsbsksis`s
s`shsjsksjshs}smsksbslslsfsjskslsesms`scsismsdsismsisesjsjs}s}sdscs
sgs~sfs
sjsgsksjsosfsisasgscsas`s|skshs`s`s|sis}ses
sdsbs}sms|sesgsgsgsdskslsks~sislsisgsdsis~sfs}scsesisasesfscs
sdsdshsosds}sjsgsmsgsjsksasesdsis`scslsds}slsoskshsbsososksfshs
sjses|shsjs}sbsasasas~sesfsesmsfsfscsas~scsmsfshs}sbscslsbs`s}sjses~sbsis
shsksasgsasdseslsbs~scsos}sfs~shsmslshsbs|sislshs`sbsjsks
sksfsesis}smsmsmskscs~s|sdsasaslsmsjsosds}s
sesjsksbsjshsesgsmsfs
sfses~sis`sis~smscsmsisksbshs`sfsbs`scs
sjsdsbscs~shsjsas~sfses|sls
sgsfsfsisgsjshsgsashsksesfsgsksashs
sdshscsdsisbsasgsgsjsjs`s
smscsoscsmsgs`sgsfshscsbsos`s|sos}sjsdses|s}smsbsks~sms`s
sksfsjsas`s`scsasdsisdslsbshsbs`sasbslsbsjs|s~sbs}s~scs|slsasasdsksasjsNs
e`Jv$*X
O-Pwi#q
a:'`K1W*X(9
V1 J4F
Y)a}gwG
5M|ww&
PmI%Cbw
qfqnnp
LyP5;"0
!O*;eK"/
xM7K{6
,R#D?	
K(d.HW
D+%1e/
0	m(me
Ao,_>u8
=oh Zd
%J	EzF
B-~&7,
K<wDR#
xEt+~)uq
xb$ld.}
0)MhRL
=E rm0
2$~w|b
[F[SCef
5q$cz"KL#vh
mZU(ie
}]6\D	^"
NAW|/,
2OU%e`C5
$pW,mY
N>(:g3
Ues`u=4
pEWa:'`
}R):	b
mA-Q`|
*r;`$Lp
ejiVhT
bK;614
9%J+;f?f
z?y:-R#
'S;cg`
+]X(v6
&oiZXt\Z
jjNK+q
S:.io\w
R4$C'W`]o
ev0h#X;
8po(X;
B8vupg
ZKC29o
nQ>xZ<r
; 0A*P
	M+J^#
%nF'Nx,Y
C~]"a~row?%
"Oe,}~6
#ekQ:Es
${.U`GXV
B*xbA$
		]~5B
PFLCs0Z
m(Bte"s
o!(lnU
^jh8/	/}
^n,q~e
t/HnY1
-spkb|
k#KU/1>
$+|deB
7NO*TKxvd
k0":7u!:
BK~d6&
9v$\c(
pz^)y8
o+o.^\
45pXF_
,cB$=B
~h4DlQ
2wnm1d
2nq3FN
Z9}!$FS
F$	Iu\
)v{#OmQ
y&dt73
o]jaA;P:Z
[rdDSb
w/F:O0
>z}y8Q
WJ),/BS
CaA!J%I
z`O\O2
C]%)P4
x'E0,v}
lR}aMf
FswL~`
2qFhR;
~	H4RY$[	PO
6pYJxW1
9Md1]c
S}gAL5v
7:zUcfD
L2G`(q
g._Fo;4Bv*u
UPF@oeU
DOD/[!
/9l+'"
2e\%k;'J+
wL9)Ep
~ :<S}B
=}V^aJ
?]9N*]h
|>uV;hj
m}}_j.
jO9tm8"9F
;Re:`*e`
00c!MH
0#}JBF;I3
RIamEVh;
3WBcVm
g-1mv4o
hT/R#sE
F]HX[m)
(dt:\H
 -L@~/
?o~!Al
k"aJf-
=$fe_8Wn
*/ei)APS
+uxpXr
o'B%W$
z>8	QX
Q+	$9h#
AOq7yz
ghj}A-
( =9Qt
a<_C*P
;N1(A+
+NLdrx
[n}Dqs
6|Uz#IhE
i3hi)Up
 &^~b|XR
&m3~8j
-Y;Y]_%
	X	-r(
ESxW0"
(-i#TS
</3()|+>Ph
82fXb)
5y3ON8
J*T!~>
$-LI1;
azRpY\
v!=D}4
Kgm!!2
el*d4+
>7oyEC(&8
Q0[IW#
u,/+C5
!z%kxn
@#\4		
JlQeQcw
U;U)+m
)i}wwT
5T|W5;
=,]h)l;]+/u
k)<5{<,
Q~B1f3&z?P
QE'Z)q
<~zi0b
V>"6d{
<7`[Zi
M*D4x3
7ZXZi|
XtczB_aT
uk"O<P
Ev/q{L
_l5kaV
SR;~wXfo
k9<#dZ
gcc8E?
=gn}6-
/7IxL}L
gWi;>Kf
d63,kU
O|%{qF
B,}y^%ral
SjLW{g6J
LnMpC+
=DfrRbkPI}F2t
#!sO>c
}/*5rL
H\p#So&6
VA'fr'6
*TZD6*
Dw.pzM
%TPF69
hH(^Sc
A WIti)
|KdRE~
'!%Mfn
B3O<#4ts
_N'*";
|6@het
}iF^OJ
f,.U&L
bzw=i@
'9(Kfw
~d;6"n
[JTf$(
|Ma:'Y
+6B}n9n
|]a:'`
'&=^fk
?q}'{m
YJ^,s[
wCO3XC
SD@E+!
dlH#:O
=.4v<M
%`|rd*
9`d;b}[J
vr[JB9
_/o?|;
O,P4G-ML
wC2'iz
6A53+1
_f'*";
%20{0[\
O,PPi!q
Czm65,
poFJ[oFJ[ZH#u
oWRj!Bf
G[S	OZ
G[S	GZ
G[S	SZ
G[S	_Z
G[S	[Z
G[S	gZ
G;2NS[
YtGT^OH[
:W[K_W
:W[K_V
G[YtFT_H
G[%;+Z
CYtGT_
!TuU!Z
=YuG&g
G[36F[
%s-[%\
CT^4E[
,3%sG[StB
:W[KG^
G	YNC	
GXEpB[
G[35G[
G[%9oZ
G[S	cZ
G[3;J[
u[3/G[
3[3#G[
Bootdisk8
MSVBVM60.DLL
MethCallEngine
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler