TextScan - Malware El Tiempo

Position,Type,Length,String

77,Char,40,!This program cannot be run in DOS mode.

641,DLL,12,MSVBVM60.DLL

7886,Char,15,      Proyecto1

8345,Char,11,tub karckak

10642,Unichar,57,B*\AC:\Users\Administrador\Desktop\Stub - copia\StubX.vbp

13294,Function,13,Administrador

13476,Char,12,Stub - copia

13728,Char,11,clsRijndael

13764,Char,10,ahorasique

13812,Char,18,__vbaErrorOverflow

13832,Char,12,__vbaFreeStr

13848,Char,12,__vbaFreeVar

13864,Char,16,__vbaFreeStrList

13884,Char,11,__vbaStrCat

13896,Char,12,__vbaStrMove

13912,Char,12,__vbaLenBstr

13928,Char,12,__vbaStrCopy

14132,Char,24,CreateToolhelp32Snapshot

14216,Char,13,Module32First

14288,Char,12,Module32Next

14392,Char,11,CloseHandle

14460,Char,19,GetCurrentProcessId

14552,Char,13,RegOpenKeyExA

14624,Char,16,RegQueryValueExA

14700,Char,11,RegCloseKey

14912,Char,34,C:\Windows\system32\MSVBVM60.DLL\3

15000,Char,13,RtlMoveMemory

15068,Char,11,DecryptByte

15080,Char,13,EncryptString

15096,Char,13,DecryptString

15112,Char,11,EncryptByte

15352,Char,11,EncryptFile

15364,Char,11,DecryptFile

17540,Char,15,DllFunctionCall

17612,DLL,12,MSVBVM60.DLL

17632,Char,14,__vbaCopyBytes

17776,Function,12,__vbaFreeObj

17792,Char,16,__vbaAryDestruct

17812,Char,12,__vbaVar2Vec

17828,Char,12,__vbaAryMove

17844,Char,14,__vbaAryUnlock

17860,Char,12,__vbaAryLock

17888,Char,13,__vbaVarCmpEq

17904,Char,11,__vbaVarAnd

17916,Char,16,__vbaBoolVarNull

17936,Char,24,__vbaGenerateBoundsError

17964,Char,11,__vbaStrCmp

17976,Char,11,__vbaAryVar

17988,Char,12,__vbaAryCopy

18004,Char,14,__vbaFileClose

18032,Char,16,__vbaFreeVarList

18052,Char,15,__vbaStrVarMove

18068,Char,16,__vbaFreeObjList

18088,Char,20,__vbaHresultCheckObj

18132,Char,13,__vbaFileOpen

18152,DLL,12,advapi32.dll

18172,Char,11,RegOpenKeyA

18344,Char,23,GetLogicalDriveStringsA

18424,Char,13,GetDriveTypeA

18496,Char,19,GetDiskFreeSpaceExA

18572,Char,26,WritePrivateProfileStringA

18656,Char,18,SetFileAttributesA

18732,DLL,11,Shell32.dll

18748,Char,26,SHGetSpecialFolderLocation

18844,Char,19,SHGetPathFromIDList

18932,Char,13,InternetOpenA

19004,Char,16,InternetOpenUrlA

19080,Char,16,InternetReadFile

19156,Char,19,InternetCloseHandle

19232,Unichar,13,B^UcfPaTK0aTb

19300,Unichar,20,K5a^bcFXaTKUa^bcfXaT

19360,Unichar,27,38A42C>AHN5>ANB0E8=6N58;4B,

19456,Unichar,25,KT<d[TKR^]UXVK_aTUTaT]RTb

19520,Unichar,12,8]R^\X]V3Xa,

19552,Unichar,26,B^UcfPaTK1TPaBWPaTK6T]TaP[

19612,Unichar,11,3^f][^PS3Xa

19640,Unichar,27,B^UcfPaTK:PiPPK;^RP[2^]cT]c

19700,Unichar,23,B^UcfPaTK;_WP]cK6T]TaP[

19752,Unichar,18,K1Xc2^\TcK1Xc2^\Tc

19804,Unichar,21,+3TUPd[c3^f][^PS?PcW-

19856,Unichar,20,3TUPd[c3^f][^PS?PcW-

19904,Unichar,36,B^UcfPaTKBWPaTPiPKBWPaTPiPK3^f][^PSb

19984,Unichar,12,2^\_[TcT?PcW

20016,Unichar,18,K;X\TFXaTK[X\TfXaT

20086,Unichar,12,cWT_XaPcTQPh

20148,Unichar,12,bTPaRWATbd[c

20314,Unichar,12,cWT_XaPcTQPh

20428,Char,14,__vbaStrFixstr

20444,Char,11,__vbaLbound

20480,Unichar,16,5X[TBhbcT\>QYTRc

20516,Unichar,10,fileexists

20540,Unichar,12,folderexists

20636,Char,16,__vbaLateMemCall

20656,Char,11,__vbaObjVar

20668,Char,17,__vbaObjSetAddref

20688,Char,15,__vbaStrVarCopy

20704,Char,11,__vbaVarAdd

20728,Char,10,__vbaInStr

20768,Char,12,__vbaVargVar

20784,Char,21,__vbaVarLateMemCallLd

20808,Char,14,__vbaVarSetVar

20824,Char,18,__vbaVarVargNofree

20844,Char,16,__vbaNextEachVar

20868,Char,10,__vbaStrI2

20880,Char,15,__vbaForEachVar

20896,Char,14,__vbaRefVarAry

20912,Char,11,__vbaUbound

20924,Char,10,__vbaErase

20936,Char,12,__vbaVarZero

20952,Char,10,__vbaRedim

20964,Char,12,__vbaVarMove

20980,Char,11,__vbaVarCat

20992,Char,14,__vbaStrVarVal

21040,Char,12,__vbaOnError

21056,Char,15,__vbaVarForNext

21072,Char,19,__vbaLsetFixstrFree

21092,Char,10,__vbaR8Str

21104,Char,10,__vbaStrI4

21116,Char,11,__vbaVarSub

21128,Char,13,__vbaInStrVar

21144,Char,10,__vbaI4Var

21156,Char,13,__vbaVarTstEq

21172,Char,15,__vbaVarForInit

21212,Char,17,__vbaStrToUnicode

21232,Char,15,__vbaLsetFixstr

21248,Char,19,__vbaSetSystemError

21268,Char,14,__vbaStrToAnsi

21296,Char,20,__vbaFixstrConstruct

21352,Unichar,17,BHBC4<K2^]ca^[BTc

21390,Unichar,20, KBTaeXRTbK3XbZK4]d\

21568,Unichar,41,B^UcfPaTK<XRa^b^UcKFX]S^fbK2daaT]cETabX^]

21748,Char,13,__vbaVarTstGt

21764,Char,17,__vbaRecAnsiToUni

21784,Char,17,__vbaRecUniToAnsi

21804,Char,12,__vbaStrLike

21882,Unichar,10,STbRaX_c^a

21918,Unichar,10,STRah_cX^]

22164,Char,17,__vbaVarIndexLoad

22184,Char,11,__vbaUI1Var

22824,Function,19,__vbaR8ForNextCheck

22844,Char,14,__vbaPutOwner3

22860,Char,14,__vbaGetOwner3

22876,Char,13,__vbaExitProc

22892,Char,11,__vbaObjSet

22904,Char,15,__vbaRaiseEvent

22920,Char,12,__vbaR8IntI4

22964,Char,18,__vbaRedimPreserve

22984,Char,18,__vbaAryConstruct2

23004,Char,10,__vbaUI1I2

23078,Unichar,10,STbRaX_c^a

23116,Unichar,10,STRah_cX^]

23504,Char,12,__vbaPowerR8

23520,Char,10,__vbaUI1I4

23532,Char,11,__vbaUI1Str

23556,Char,12,__vbaStr2Vec

23606,Unichar,10,STbRaX_c^a

23642,Unichar,10,STRah_cX^]

23668,Unichar,18,XfnbOfmjGfmvepNufH

23712,Unichar,14,Tppb`loMbq^bo@

24224,Unichar,20,qrlwfhViRzhlYsdpqXwQ

24272,Unichar,14,uB`lii>i^rqofS

24308,Unichar,20,|urphPodxwulYhwluZwQ

24356,Unichar,18,ebfsiUuyfuopDufHuO

24400,Unichar,18,ebfsiUuyfuopDufTuO

24444,Unichar,14,a^boeQbjrpbOqK

24492,Unichar,42,L\I\JLOOJIRQRNWKa\mZiUQ^WJa\mZiUJNQIMK\M[Q

24652,Char,13,__vbaI4ErrVar

28308,Char,11,OutputInHex

28348,Char,11,IsTextInHex

171664,DLL,12,MSVBVM60.DLL

171680,Char,13,__vbaVarTstGt

171696,Char,11,__vbaVarSub

171710,Char,10,__vbaStrI2

171724,Char,19,__vbaR8ForNextCheck

171756,Char,10,_adj_fptan

171770,Char,10,__vbaStrI4

171784,Char,12,__vbaVarMove

171800,Char,18,__vbaVarVargNofree

171822,Char,12,__vbaAryMove

171838,Char,12,__vbaFreeVar

171854,Char,15,__vbaStrVarMove

171872,Char,12,__vbaLenBstr

171900,Char,16,__vbaFreeVarList

171932,Char,13,_adj_fdiv_m64

171948,Char,15,__vbaRaiseEvent

171966,Char,16,__vbaNextEachVar

171986,Char,16,__vbaFreeObjList

172006,Char,11,_adj_fprem1

172020,Char,17,__vbaRecAnsiToUni

172040,Char,11,__vbaStrCat

172054,Char,15,__vbaLsetFixstr

172072,Char,19,__vbaSetSystemError

172094,Char,20,__vbaHresultCheckObj

172118,Char,13,_adj_fdiv_m32

172134,Char,11,__vbaAryVar

172148,Char,16,__vbaAryDestruct

172168,Char,13,__vbaExitProc

172184,Char,15,__vbaVarForInit

172202,Char,11,__vbaObjSet

172216,Char,12,__vbaStrLike

172232,Char,12,__vbaOnError

172248,Char,14,_adj_fdiv_m16i

172266,Char,17,__vbaObjSetAddref

172286,Char,15,_adj_fdivr_m16i

172304,Char,17,__vbaVarIndexLoad

172324,Char,14,__vbaStrFixstr

172354,Char,14,__vbaRefVarAry

172372,Char,12,__vbaVargVar

172388,Char,16,__vbaBoolVarNull

172418,Char,10,__vbaErase

172432,Char,12,__vbaVarZero

172448,Char,11,__vbaChkstk

172462,Char,14,__vbaFileClose

172480,Char,17,EVENT_SINK_AddRef

172500,Char,24,__vbaGenerateBoundsError

172540,Char,11,__vbaStrCmp

172554,Char,18,__vbaAryConstruct2

172576,Char,14,__vbaPutOwner3

172594,Char,13,__vbaVarTstEq

172622,Char,11,__vbaObjVar

172636,Char,15,DllFunctionCall

172654,Char,18,__vbaRedimPreserve

172676,Char,11,__vbaLbound

172690,Char,11,_adj_fpatan

172704,Char,20,__vbaFixstrConstruct

172728,Char,10,__vbaRedim

172742,Char,17,__vbaRecUniToAnsi

172762,Char,18,EVENT_SINK_Release

172784,Char,10,__vbaUI1I2

172808,Char,11,__vbaVarAnd

172822,Char,25,EVENT_SINK_QueryInterface

172850,Char,12,__vbaStr2Vec

172866,Char,10,__vbaUI1I4

172880,Char,18,__vbaExceptHandler

172902,Char,17,__vbaStrToUnicode

172922,Char,10,_adj_fprem

172936,Char,14,_adj_fdivr_m64

172954,Char,16,__vbaFPException

172974,Char,13,__vbaInStrVar

172990,Char,14,__vbaGetOwner3

173008,Char,14,__vbaStrVarVal

173026,Char,11,__vbaUbound

173040,Char,11,__vbaVarCat

173054,Char,19,__vbaLsetFixstrFree

173086,Char,18,__vbaErrorOverflow

173108,Char,13,__vbaFileOpen

173124,Char,10,__vbaR8Str

173138,Char,10,__vbaInStr

173164,Char,12,__vbaVar2Vec

173180,Char,14,_adj_fdiv_m32i

173198,Char,15,_adj_fdivr_m32i

173216,Char,12,__vbaStrCopy

173232,Char,16,__vbaFreeStrList

173252,Char,14,_adj_fdivr_m32

173270,Char,12,__vbaPowerR8

173286,Char,11,_adj_fdiv_r

173300,Char,14,__vbaVarSetVar

173318,Char,10,__vbaI4Var

173332,Char,13,__vbaVarCmpEq

173348,Char,11,__vbaVarAdd

173362,Char,16,__vbaLateMemCall

173382,Char,12,__vbaAryLock

173398,Char,14,__vbaStrToAnsi

173416,Char,21,__vbaVarLateMemCallLd

173462,Char,11,__vbaUI1Str

173476,Char,12,__vbaAryCopy

173492,Char,12,__vbaStrMove

173508,Char,12,__vbaR8IntI4

173524,Char,15,__vbaForEachVar

173542,Char,15,__vbaStrVarCopy

173580,Char,11,__vbaUI1Var

173594,Char,14,__vbaAryUnlock

173612,Char,15,__vbaVarForNext

173640,Char,13,__vbaI4ErrVar

173656,Char,12,__vbaFreeObj

173672,Char,12,__vbaFreeStr

189617,Char,10,BBBBBB<00/

189665,Char,10,BBBBBB<00/

189713,Char,10,BBBBBB<00/

189761,Char,10,BBBBBB<00/

189809,Char,10,BBBBBB<00/

189857,Char,10,BBBBBB<00/

190143,Char,12,pppp33x4;00/

190241,Char,10,ppppx~<00/

190287,Char,12,ppppw:BB<00/

190338,Char,15,x;BBB<00///////

191702,Unichar,15,VS_VERSION_INFO

191794,Unichar,14,StringFileInfo

191854,Unichar,11,CompanyName

191880,Unichar,13,Windows Media

191914,Unichar,11,ProductName

191958,Unichar,11,FileVersion

192002,Unichar,14,ProductVersion

192050,Unichar,12,InternalName

192076,Unichar,12,stub karckak

192110,Unichar,16,OriginalFilename

192144,Unichar,16,stub karckak.exe

192186,Unichar,11,VarFileInfo

192218,Unichar,11,Translation

192512,Char,14,&/&%&(=)%&&%*V

219461,Char,10,;ReP^K X{%

224651,Char,10,f^,uTeu]l{

238242,Char,10, =Z"@2P,S^

274444,Char,155,&/&%&(=)%&&%xRC4&/&%&(=)%&&%SXS79YRJKoZZsUnMLkFc5QwXR6nmaGir5zBh5aqffcVZQDP9DY&/&%&(=)%&&%&/&%&(=)%&&%ANTIS0ANTIS0ANTIS0ANTIS0ANTIS0ANTIS0ANTIS0ANTIS0ANTIS