Sample details: 63644c737d78ab0ce805583714a945b6 --

Hashes
MD5: 63644c737d78ab0ce805583714a945b6
SHA1: 39a78521b5fa70e12607bb449a7d26659941a256
SHA256: fcf301c2381be7cd453721eaaf7cba31365483662f22e55d90a5dc51c36cb296
SSDEEP: 6144:yFZLLlezfwwFQKWan8nNZfLG7ZViz/1HBGfUaOMmauJec4ymhT+OgLelcMQOmV:+sTFQ9LDQo/1hGczx4ymh9OMzm
Details
File Type: PE32
Yara Hits
YRP/Microsoft_Visual_Basic_v50v60 | YRP/Microsoft_Visual_Basic_v50 | YRP/Microsoft_Visual_Basic_v50_v60 | YRP/Microsoft_Visual_Basic_v50_additional | YRP/Microsoft_Visual_Basic_v50v60_additional | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/HasRichSignature | YRP/domain | YRP/contentis_base64 | YRP/SEH__vba | YRP/win_registry |
Source
http://metroopm.com.my/create/mec.exe
http://www.metroopm.com.my/create/mec.exe
Strings
		!This program cannot be run in DOS mode.
`.data
MSVBVM60.DLL
Cubitocarpal5
Psetta
Psetta
Diatriba
Filamento
Peremptorily
Usuhsb0
Muffs4
Parisien
Seusss5
Choicy
Flagworm0
Joceylne
VB5!6&*
Hernant1
Partain
Cubitocarpal5
Cubitocarpal5
Curares0
Oligonephria5
Slobbers
Usuhsb0
C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Peremptorily
Choicy
Parisien
Flagworm0
Diatriba
NTDLL.DLL
RtlCompareMemory
blao5.dll
Kapustinskiy3
kernel32.dll
EnumUILanguagesA
ADVAPI32.DLL
LookupAccountNameA
RegQueryValueA
RegQueryValueExA
RegReplaceKeyA
RegRestoreKeyA
RegSaveKeyA
RegSetKeySecurity
user32
RegisterClassExA
RegOpenKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegSetValueA
RegSetValueExA
RegUnLoadKeyA
RegisterClipboardFormatA
RegisterEventSourceA
RegisterHotKey
RegisterServiceCtrlHandlerA
RegisterWindowMessageA
RegLoadKeyA
RegNotifyChangeKeyValue
shell32.dll
ExtractIconA
DrawIcon
kernel32
GetWindowsDirectoryA
VBA6.DLL
Oligonephria5
Tinning2
Tinning2
Slobbers
Mindencity7
Mindencity7
Curares0
Lynnelle
FR`m6{
SMIo*ea
n+UpD;
s8M,hY
T2_rkt
4+=u0 
sv3Moi
('.[*f
gy3nn\
 &Mp}2i2P
ms8M4oVL
Gl}lGLv
'=11L8
]F4#*Z
`?/X{0
`7/s8+T
%eaX],X
X#&Goh
TmBS10<
$LzDkg
+(u?TxY	
Zw	G/E
eqO#'`!mI
yrX$yz
/k#JRjx
5<kehX
mOBRWQ
5|6Qh+"
Bjda5k
13@GIx
o)U`s,
ZC>bGJQwR
H)d$ea
w0DAIs
>n4@&Mz
8B:7K=
%.>3E%
:jQkjcc
)u8U~^i
u0DGMd
SBUt#Z
u<sbH;#}
iwo@>9?
.84~Q:
n%-\y[
c]B7:e
;	-E6Q
Vv;[KH
?{gQvH
2EA?R~p
pvwl5 
'Ekj{e
BU|!^^y
w2{F'D
ILAv	Y
f8Ms<t
MHAv	b2
WXQpRi
%m~7Hw`
=80B0r
-Q@<RF
9)V!T%yz
S%\3V,
D)v4#Onj
	ROrfc
^gp8+xo
{(%%|O\
y4o	jo
L9-I]RU
@l2d!q
'bCf{:
inFiTuw
FC-+]sh
a05j5S
jYDrGg}*
d\]{9R
3<,6[	Io
(-MGvM
L{O+4$
EmW;iqa
7o0H6c
>AO(>n
OvQ9bD
pHUFP_p
	hS7s8
53KG5&
;#&Gof
BU)Uh4bc
Jt9kPy
-Q@<RF
 +sMtwo
	!c?t 
6J|B=	
riOSW&
eRPj3P
{?2,_sY
^@,='pl
EJj&VD
W;iwQH
H</`ciH
@\8'pQo
!ea;Fd_
\EQk-?
>_0/6x
54|p'Y
i]Gi2$
g[{p8+
@X:'poWu
T:V;#&
K+2)EA
[:fN>*
9</`"dI
uDGG@~
+EGG@l
G6c9W*
#]#gnva
g5/:o<W
t($l2C'wO
]s|\l)hS
6QB(/`
L!fF%Vx
t0DGqrQ6
a83z#[
-!.&H^
Zb?7	D45~
U-ElM`
6Jn	D4
G[%5L6a
U(PbYf
F#_z"I
WC>^Z-
4=;"k	J}
:@KQ$3
ufBDh/*
**Z['J
L(5UW$
*eP	}!
?T~F}B
r(3*iI
^:<,\W
7s8+R7:
4{au0D
'p&@Zl
7sX]o	*
bq3UAw
u#1MAv
W6p+m:
A	zR0d
tw TMq
ESY_-@Y
_#v=nH-
3<M?ZBF
<q&r(3
Ys]+~h=
G{ku0D
s\+ihu
Hdoso*
k9qP/e
XsV+ h6
C{vu^D
sV+yh,
P{vuQD
bnOh^7r8*
o209"t
ad:HDn
g"jxY=
XX;so[
hoRr(a
5k(q0D
?s8[giI
X|^bvN
4_st ^
l,Kdql
7s8gbiI~y
<`^b4V
4C{t M
XP:so|
v	BRs`
o^"6^6
7s8{{iI
AY1$Vm
veSzva
k=,1'}
	oPi2*
Oy3_zR
ltp}u>
}cKka$
E.#	BR
7s8CoiI
7sH+lhY
|s8+~h(
A{2ujD
st+lh-
7s8+~h/
x{Ju0D
7sZ+~ht
sb+ZhY
4{~uBD
sB+zhY
4{yuQD
sH+ahY
LG6cPS
}!Eu0D
ng3UO!
F	^b~V
Xc	+pPzw
T,`;#&
"mI>^R
 p7c8+
%eaN</X"mI
'-mIz:
S?QEh<6
4|_rpV
df!RAw
nn7`]C
sU3M[`
/x62v2
Ev4GKw
`k;KEi
t7}mJ 
f4{su0D
^>\u b
E2RyFn
`#cA?e
s[@,#'
pQ_ru|
R	l[>]
Z&gfmz
2SEt0B
kg}Dj30
%|dd0D
	BTE$.
TrDW 3
6S^u0N
>{/u0D
4q3\N}
](Q'!G
E=pTw9
6s>2 d
>SMu0N
C2JZ8+	C
s8*pwY
La8+	E[
7s8UJhY
[s8+"hY
@47s22 j
X;s@lW
U!d\>T
_ry~e`
7s80=lYjy
pe_ruz
s8+AhY
7^8&7hs
70^ruv
C*5d.3
a	PWUO
pL_ru~e`
4}5u0G
y9R!*j
~NR!/t
s8-'er
)X_r~L
%y'%.r
tr8!~,X
7s)XCiY
4q4t$I
)s8)%.Y
rm\w6q 
0|Gf4M
7b.< p
yXR!*)
ms8/bjX
%qK!.u
_vksQ>
Us8/b3X
_&vf8Q
1t;DQiY
6\lQ\B
>}5u0D
Cd&v/s
2W!^3N
s8-%^X
6s21 X
,ki;j[x#
\	r{Y_
7j^runlb
4`p 0D
6s8U~hY
s`QvnSK
3b>DVhY
yrR!*j
&e_r{9ua
[6tqt}
@ 7s>=
2]4i<o3
W:#,4<
'CM!.x"
8+	kqOy
`;# mB
k-	14%
ruY-z`
pJ9*<54
u1yT}A
_x}-j`
C'>q:P
P;v@ZW
C	j]>J
tsDm|39
m;\`P"
Tu4M$B
1|$9nX
?{d{c}
T[t*z3
Lss;auTt
m;^u#`
z[t:Du
\}qow7
u[u>Dm
niK`7u8
]?	yYl
s>+9LY
6#8C;hY
]{[#0D
BbW.o4
j,7GK+
XZxNFc-L
v=rL3o9
	TRvsg8[Pj
;#&x5 
Y'~"a`
lGnuW*
#LgnX6s8+
7s;+Kk
~2_r|V
4H;u0F
7{V#0D
hJSs8*
k,-v9r	
?'Bw_V
atu,D=
PXBug]
5~^1p9
U'u<@e6
Xl@fQ(O
Fk]yi%
j]2v8k
Ts+*Do:
Dr-Qr`
9GsO!5}
DkieMTB
Do;D@q
&y6/a:
CB3,z2
ko7BZl
c@=EKD
ul1D]v
,|#4j;
Nm$@Bl
uf3L.H
tf?CB|
uB&U\l
Tf WGf
sJ<sAi
fo'Dz|
Hs&HAk
[5i[c.
$>#d@s
bMJFz!
?-_QB'
N4;xLP
2&+-7n
POE'	,
uF"ur%
hM$oE8
fm6!~i
nh#cdg
V7Oi`78
?-_QB'
M>ZCww
:r0xo\
wd$3w/
w*"H0g
3gvoJu
d@Afx:.
gL:+@!
$>#RV6
NIDR&i
v\bFmW
Ua8la]
tCQgOP1
zi7"|?
z`>-c1
FGSiR#3
6a;xwC
ea7!47
@YkNCO
R+->u<
T7^eD./
bD*PM\
vh PmZ
Mwdryi
B{;RZv
>[\l `
@9ARK26
d)B|^>
){<+J$
7'>nak
fKI"f3
NIM}&:
v\6pvT
)FM@0j
$>#VAb
P*]g\[m
w1*@Jc
5d(330
p2||aYj
n;1UdL
$>#tq_
U4vBh+
p~>,Cd
~6|Hc\
C"}0V)
264okS
r6&sWl
EM;I{l
f@ynK	}
""l#Bk
0taE[n
FD}bAP
:r:xcQ
qFGdF9
Mn`S{=
0_8tpj
|BP|?,l
5qj<.1
VOI-Y/
nd`hG@
A%|^O'l
MT#Io8
2x)0g?
6MbLHN
7&m*;&
V/Q7Y,
?n9nBS
~6pc.&
pJSDJX
m_T<\,
?j9u^3
gKPF8;
C(M1P;
$>#DKA
v0J/[ 
~z3'`<
Ro4xzG
u~)tdj
P&wgx#
/Q<C	r
X;IL0UY
vtkg|3
F$S{nL,
t%[MB9-
!Vf#Bk
DD=JJc
b2amjG
p6JH0g
PM&pof
bCiL0UY
nZ0Jhm
|%jN|2
 NM@0j
CF1XA8
D*M]L^
1\{"7=
$>#vOH
#MJJ&n
PGvse@
C(M1{n
c6aU@1
nF%t@d
UL'W|W
Vho!Xd
x({>~ 
nF66H0
:rc@L]
NIC9Z(
i38YqH
5f+QkA
(^<wx=
-h7-O7
gCgQ]"
m;WRw	
,Rmc86
Q(R6S0
K{?UqF
}CY@fw
u*"H0g
5w4rvp
Y&ur_%<
qE4RvV
oB'&(g
to9YO@
]d7yvZ
V8mb\'
nBW/V%
0ycYOO
}C\JR_(
{-.65:
f9~_T?.
fv$UCQ
q<`O)?7
/-br\k
1Q	sp'
B	&4\!
sxH7.j
pmReGv
#55xM8
@4vA\Ud
vp&`WJ
\0G*t 
UEe~qC
O	^{\70
/-br\k
M5=CwD
~z>w%5
-C&p&4
26`sZ`
$>#mbm
bGngkY
5R6OOr
TMjWw5
]U!BeH
oKuMt&6
Z=G<Z&
iu=bqG
46M@0j
	J(OBV
!Abr\k
^G[oB[-
)\7:>k
l7Z9g*
46M@0j
g<]1`>
z#Wa|1
1m'&b.
Ie9jEW
d0S1F=
s}H( !
'S 'V0
h`9iOv
sw;OIv
Nm<D\@
sb U[u
b`&N\|
b{&!yw
/g$%k#
uf<U{v
f`&HAk
7 PDzh
bP&SKd
\0W[th
bb6bFd
"o#4a>
df!!I`
7T1$w%
cB!X@f
\0^pqQ
bp|q\j
r5UD]m
)uNAtc
2y0,	fW
		U%<1
#*.];V
!]GYw[
#d3n0P
mF@aZWO9X
>G!ucCj
(LZu#:
2%c.41
tWk=oE
Q-NoDfx
A-Ab3/O@
;4j|Cy
35'k3nH	Z`
%W1Gs9
~TT1"zJ
hf2@f_
uli:&R
(xexOO
$}BpcJ
gps[%U
a=jJWj
E2W`)`
ZV=A1U
GJ1epo'wx
LrZ%P(Cx
]<P	;q'E
.@Fm02
?U*:N<
eGD:x4D
z1t)Q)\
1_tYST;
N_c|13
H6@L/}[
@1L1'if6
gWO>p=
tI&>Y.8
 [0Y:^
x#c:+o|
@ ;=5k
Hq1.|.
M)blWV^
e9\|Df
YcYl!$
)y=Wg>
kVz=*C
Y:~,{nm
uc7[ov
Ijvpu'
`8%ynq
^F>-N_Q
S|??h'
AOf,KWu
"]F<m>
&*-1k*
 "*2	)
R[n,[	
&2LZoO|
_RoW:G
L5Y2ppn81E
:Z+@Vj
Xf<yM8
RgM(&)
EKv}nm
^VOFo4
?6`{Z@
*T]B,*<
B@!dfy
~g-+uA
sO+`nbS
4@+OONS
,(9AVxD
:HtzdX
.J?({0
z/+>&A
dx7;xn
4>	IT1
%>S8e*
V_b:&4
|t`{f2
/$[x/p
hvKyYD
o[T;(cfw
/rxjyM
h~ke(E<
R;bM'%
%synmO
+GJdAe
,Sw*XOb"
 WEGCJ
dDlo`&
G$64M$
A]gGe$
)Z[P= $*
St!*)F
dGJ&&1A5
pGJ:5r
PR6vMQX
G2\;	s
LuSb["
a?u$(Te
@7/$;A
>LOXh'
	!,NO~
Oujvmh
8=V9*L
^0&aab
[/h`{$
snmv	i
l%]WHZG
FBsYkD
N**YzE
lD8./N
|m\W=]
KgH3o:
i}a*0K
P?ggM9oo
8}.tx8:
%sgA3&
7+.h_SU
[-$>Hq
<GBF0kSo
,v'y6Hb
>w.1yq
#tGjV]
s4Ftl^.	
E4W4>X<
zj+fx;
y,i2Ogo
>x5xZ[k4
%K'i4Z6
~t{dU6i
T. [!P
#6_6va
;IGwWK
fob#Q.
ExJ_AL A
oW:za%
sn1'-!
{	p;9cvU
@aCD>BN
yxV8M0
wR+w*v
f<dq+*~
%gg\wU
=b<%'AM
xFmQYz>
Y<sPLi
`A8^jf
5o~$V:|
(<TGTm
]C y2?
~+!d6'
MyzhB>
B&)^S*
kOfHKf
&a:e;#h
 G5$m@
dng95[
~,^&ZO
7h0v?h0v?2yl
{C@3HC
6351Gs
Lynnelle
MSVBVM60.DLL
MethCallEngine
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler