Sample details: 4d338da1a2c3facd8a4eb70c2ff76791 --

Hashes
MD5: 4d338da1a2c3facd8a4eb70c2ff76791
SHA1: 168ee5eddcd1e5f0c75d21860e68833eba0ef3e5
SHA256: 133ae28bce4d3af3eaf5c07b5e9f3174db465afcf33693a4382f8798d1e9e62d
SSDEEP: 12288:d9l/ImN81M63WCux6OOz9siTMgjMTeqIo:dvIW5DSFjMQo
Details
File Type: PE32
Yara Hits
YRP/Microsoft_Visual_Basic_v50v60 | YRP/Microsoft_Visual_Basic_v50 | YRP/Microsoft_Visual_Basic_v50_v60 | YRP/Microsoft_Visual_Basic_v50_additional | YRP/Microsoft_Visual_Basic_v50v60_additional | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/HasRichSignature | YRP/domain | YRP/contentis_base64 | YRP/SEH__vba | YRP/suspicious_packer_section |
Source
http://188.209.52.29/sand/exe.exe
http://188.209.52.29/sand/exe.exe
Strings
		!This program cannot be run in DOS mode.
`.data
MSVBVM60.DLL
MB|^N,
Reefer7
Leverman
Endpoints
Endpoints
Canoed
Zemaitis
Deonne5
Daisied6
Autoalarm
Kensitite1
Fainters4
Kilker0
VB5!6&*
Paramater1
Unstrictured8
Reefer7
Reefer7
Leverman
Bishopess0
Skutt7
Strutted1
C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Zemaitis
Fainters4
Autoalarm
Deonne5
Canoed
user32
AttachThreadInput
ImpersonateDdeClientWindow
VBA6.DLL
__vbaFreeStr
__vbaFreeObj
__vbaObjSetAddref
__vbaNew2
__vbaVarTstEq
__vbaVarTstLt
__vbaVarMove
__vbaVarDup
__vbaStrVarMove
__vbaStrMove
__vbaR8Var
__vbaSetSystemError
__vbaFpI4
__vbaFreeVar
__vbaVarAdd
__vbaI4Var
__vbaRedim
__vbaEnd
__vbaHresultCheckObj
__vbaOnError
__vbaStrCopy
__vbaStrCmp
Skutt7
Fleshlike
Fleshlike
Bishopess0
Lissie
\xxxxx
@CICHB3_1333
kkkk{k
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$D$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
zIB3ead
F""r%o%_
IBBBG.
RXX@$$N$
IiIbbm
AqQQQ<y
FNW544
7;dY.Y3
RY3Y3ceK~T
X|#"%O
HIbb9?
f#Y3Y)
EE((/(.
i#"HO%M
HOFoYQQ#{
#Z,$$X
|u=<<C:+
mt$S#O
;P/._P
H"H*ut
F)""Q9Uv
pJNKOO
%$$N$t
n`d""J
( y[mm
2J7I{2?F5l
a2N{r7Q
9Epy<Z[
r7Q{2FF=
R*W+v?C@
_[&$$Qj)
MpY<q[2f
c?<'q_\\#q
Oy74$[
bb~!T/
A#FlI]II:Y
[vG:Rh
j[vG:Rv
`qA0lw
Y<@[*vm
EhA<Tp
[[JOEE
[]\\KH"
-8fommzA
95=@FGGE
@[[.())
((]lmm
yq"$%%
bbbbbb""
U\C%=U0K?
M[7%F3
]QQQ%9
C333lmh(F
(N !$$
yq"'%%
rBR33m
RU<'$$
mKbb35
}Pij<@
XZZzAh
_#31LzE
zDb44H
yan$%%
HOOO;D;Q
((]XZZ
QCB[3#33e*%
IR\\(S
(b(3bd
BFHI#]
FNw64$
[[j+)E
%$$wrL
[S*(EE
#O#*# 4
7?^GEE
GGG;>q
bbb;`}
bU*&7^\\
H((1XZZ
KCB(BY&
+8hM1|'N
+z<h44
DGGW[`
6HDyy9
pIH$%%S
#/"$$X
>=p'&8#]3
hlmmCO
_2"V{t
%WAkkkk
, MXZmz
_C6-EER
OPPQ9UHII
[/6GEE
~zxx([[D+))
3?*Gyyn
W*H"%O
(05Xmm
CBC333
&Y3Y3b({.
]QQTQII
eyY`	nww
V<%O%O
Y7bKHV
Yz1wmm
}gg<<@
%O;Q;I
#/8$$P
y,fimqq
.c3`=G
\\({ g+
#XY,$P9N
&2erjk
V<HO%N
;Q%P;S
33Yte*
\$$tN$N
;/;P;Q
77*BEy
744PVs!$$tu
.rGG;|
_B %%:9
 H"H"HO
?DOO%[
w*H&qHN
%OO;_%}
(B(B(BY3
_S.GEER
( fimm
sJ"MOO
jkkk53]
v3_\\.&
QQQ9NKKI
>%@EE1
7/JAEy
(0bomm
.""H"%O
CBC333
]$$uwr
2333aU*
>Y;cde*
w53%v%
.n#9CB
23`\s(-
z o44H
V.MSM?w
=p(.>U0))U~
[5133c..y^\\^<
OO%O%D
]33Y3Y2.
=2kk;|
VQQ;Q;\
oT;55`EGG&
jommzOs
F^#&$$
-33Y%eK
}QTjjH
7333Kj8
W*H#%q
BB[7233
FJ$ ""r
NN5><<
77NGEE
s333 [
Py,N$L$
(B(B*N33;Y3Y
<wN$usf
H#;^SQQ
n0sk?[
K3o3U*
$$$N$t
MiIII#j
rf~9jj
QQ;Q;D
6443Pq
UUUUQU
44$R^+!$
5ibb[:rlT!
hjj}G=
f`bb1Np
,L$4$$
+js<<@0
}pxx+/
2vusfM
t[;33b
=zl9mm
Pq,uN$N
"J"2""
}0xx/(
aec`KN[\\H
z6hmm@
dvwZM}>
33(S g
xx[S:-))
N#3F%Y
o*qH"%O
"""H"HN
Y3Y&.&
S]#`kk
QQ9RHII
OEOQPQQQ
K332333
v}yypu
Q<]#I#J
k_OO$L
@IIHIbb
jkkk03]
m['OOO
E#I#I#I
Y2!2C%O
aBBcY3Y3`
GGG1=e
(.>I\))[7
<~"""D
+W:<<yy
?RBF+Y3Y&
*(OOKOOO
MCII#d
>EGG36
GEOO%Q
{I33(5
UCII#I
E#I#b54
=0EGGP
j}xx[C^+))
.6+^\\]
`EqwZ&a
mTsUJF-
(B(B(BY3
0'"O:j
UCII#M
'II!P``b5
({ww`5
O""J;MMO
!IMbb3
FNk $$
_?FAEER>
TJ$ ""p
((nimm
7?FAEE
FF7044
OJ;  "
Tbbb4~
QQ9MHII
100034
QT>lkk9
E+***)._
TY\\ g
( x[ZZ
U_(EE?a
}io<<@
`	vwZ&a
c?V7`M
`Nqww&a
~~#'&]3
]5ZY2b
FLAQQm*
bs>Snj
nh x(m
< jHKK
o/e_7 A
MrK/y$
+n=<<@0
>#"""y
s.Z#Pk
jH}E9"k{^
l&L]GY
l;8/4h
(?Rjle
G1CZgZ
X=pV(L
Mc-3Wi{
6#=abv*
f/Zv, ?
{wA:D_
JJJJ450
ymlp~2
13aeKd
Jjbb1N
(0Jemm
,o:9;PsCGG;
]XZ %Q
z3]m4@
NOQQ%`
HIII=J
tuJmMOO
RpGG;|U
<%%S\j
`bbubb
`~\ZZ&a
$d$$L$
21""sp
CK7333
X^^@$]
vS$%%2
unbb42
c))]B9~
h/Nl%PQ
z	om4H
EGG;|]
j$$Pi0tuN$
([(H'e
_Y`W"ww
[SC(EE
[S#(EE
@	\\ g
>pHEE9~
9JYZxBa
FNK844
K`SzvZ e
>#"""|
BB${JF?
o]\\^_
}Sb<<@
LuKA:A
HIbb9?
c><<NN;	
o[k56{0
BBBB7>mh
EJ!#""
}9i=<I^W=
GG3v3Gs
^; $$!d
YZZ76:
z1dmmd
}&`jjc
C^/s50Fco
#-$44P
z	 44H
G*eK^N\\
`uOZZ&a
}v.<<@
zc:l4H
_5QQ-j
9qcOOWB
sBI/cT^
3BP-s~w
|=2zz9(
	/Ms1,
beRN['
u0"2+-
\1Xu0."2#%
wXP+))
oqE%4j
dfL9/	Z
q&&&&G6
a)GZZfM
CCCC"o9$$
g)wjjV}
iY0q]&B
JOu+nk~qi4QT~
eZ)^D:h
M_R#t{
q FTa\t
#dR*QTc
#lS{a~y
	>hnsB
s@"#o?
B>Mzmj
-.*nE'
x5Ju/H
FhfYJo
T[~<"A
b4jNDO
,%nkJE
lmSFFe8
$J\CEc)Q
9Z:2v	
Up{t)	n
JASwK8
iBEkfj
2x<8yOaMA
utwi^]w
r({=(-
0'Dhe~
.ko>6q
Np_<z42
e]:WNxw
AW-Qwq
=h\aR4
vlcUrl&7
qzOB"c
BC>x7_
k2Ic~B
~{cAzm"-
skYE1M
xFq%Z}
02aMwc
}stazY[
m<Ci$B
]`8]~RY3:
Pi$$Sb
XQ;`^R
R2 1e*_
%rAi{S
TIaJ'K
Tiyho7A`m2
h?qu'<
Rb~8?jr[
 y:S,B
a4wv``
	/uv?p
p7	Cv(\
O~XF1fhx
hbZj	H
dQV?fLj
<X&N=$
G.d.$y
b8l]N[
&b	tg?2
VWnl<xe
mneaI;"
W4FO7d.Q
pI.h=J6
11c?wQ/H
4k`KRp}
U;q ]d
n17_32
p!y!3^
YiR}X[
iM)ZK[
Y1'1MO
x<[*9'g
~S{Aa|
 J0)E9
li1]:/~
-3,+pR
>_9_no
oKF@,+
|uXwi,z
Un>m#o
E"c-ke
$!5XC q
u=LE@zX"
K%	>2xqF
Eln<d*:
V,j~wX%
\TAO#,M
&+K<MSv
ys 8p5
tKzw?K
9kIV\J
E}` k.
Y/b(:o
<KUg2a
zojt1a
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQkwvDkwvDgX8
BBBBBB333333
$$$$$$
kkkkkk
xxxxxx
""""""OOOOOOQQQQQQIIIIIIbbbbbb
%6RXEw
}yz{|~
xyz{|~
wxyz{|~
xyz{|~
~||}}~~~
{{||}}~~~
'1:55567;8(
^]QPJFEEDGHM<SO|
Lbbbbbbb_^
UdddddddddddLdca<
`eeeeeeeeeee
0ffffffffffffffff
=llllllll
llllllV
ImmmmmmmmmmmmmmmI
Yggggggggggggggg>
",hhhh
hhhhhhhhhhh,
?iiiiiiiiiiiiiiiT
RjjjjjjjjjjjjjjjC"
-nnnnnnnnnnnnnnnn.
@oooooooooooooooD
*kkkkkkkkkkkkkk
AZZZZZZZZZZZZZZZ3
++!2229wwwwwwww4)
wIMPSVY
HIMPSVY\
lIMPSVY
b`bfiU]n
Y\`bfk`S\UVWbt
eY\`bf
k[XY]mw
Y\`bfkmRkvRSWj|
~n^[]dow
c`bfklRi~PQRSTUV_r
kNPDRST<VWXYa{
|gSTUVWXY
LKJbtx
!3752/.,+-0*
6:::::::983
;;;;;;;;;;(
D!@@<@@@@@@@#
!)<<<<<<<<<<
4=========4
AALAAAAAAA&
BBBBBBBB
>>>>>>>>>>1
??????????	
KKKJJJ___
nnnIIIRRRqqq
MMMMMM\\\555999CCCJJJDAA
fff<<<MMMggg
^^^DDD
nnnPMM
FGGG^^^
vvv@@@
zmmooo~~~
QQQDDDYLY
===PPP___ooo~~~
vvvEEE
uuuYYY
mmmWWW___ooo~~~
uuu~~~
qqqIII
uuufffzzz
NNN333
sssttt
vwwwLLL
tttppp
yeeeMMM
ccceeeyyyNNN
sssOOO
~~~XXXPPP
}wwggg
wwwa\\|gg
onna``hhh{{{
Lissie
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
}	SWVP
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
__vbaEnd
_adj_fdiv_m64
_adj_fprem1
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarTstLt
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
__vbaVarTstEq
DllFunctionCall
_adj_fpatan
__vbaRedim
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
_adj_fdivr_m32
__vbaR8Var
_adj_fdiv_r
__vbaI4Var
__vbaVarAdd
__vbaVarDup
__vbaFpI4
_CIatan
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr
~~~XXXPPP
}wwggg
wwwa\\|gg
onna``hhh{{{
KKKJJJ___
nnnIIIRRRqqq
MMMMMM\\\555999CCCJJJDAA
fff<<<MMMggg
^^^DDD
nnnPMM
FGGG^^^
vvv@@@
zmmooo~~~
QQQDDDYLY
===PPP___ooo~~~
vvvEEE
uuuYYY
mmmWWW___ooo~~~
uuu~~~
qqqIII
uuufffzzz
NNN333
sssttt
vwwwLLL
tttppp
yeeeMMM
ccceeeyyyNNN
sssOOO
wIMPSVY
HIMPSVY\
lIMPSVY
b`bfiU]n
Y\`bfk`S\UVWbt
eY\`bf
k[XY]mw
Y\`bfkmRkvRSWj|
~n^[]dow
c`bfklRi~PQRSTUV_r
kNPDRST<VWXYa{
|gSTUVWXY
LKJbtx
!3752/.,+-0*
6:::::::983
;;;;;;;;;;(
D!@@<@@@@@@@#
!)<<<<<<<<<<
4=========4
AALAAAAAAA&
BBBBBBBB
>>>>>>>>>>1
??????????	
}yz{|~
xyz{|~
wxyz{|~
xyz{|~
~||}}~~~
{{||}}~~~
'1:55567;8(
^]QPJFEEDGHM<SO|
Lbbbbbbb_^
UdddddddddddLdca<
`eeeeeeeeeee
0ffffffffffffffff
=llllllll
llllllV
ImmmmmmmmmmmmmmmI
Yggggggggggggggg>
",hhhh
hhhhhhhhhhh,
?iiiiiiiiiiiiiiiT
RjjjjjjjjjjjjjjjC"
-nnnnnnnnnnnnnnnn.
@oooooooooooooooD
*kkkkkkkkkkkkkk
AZZZZZZZZZZZZZZZ3
++!2229wwwwwwww4)