[*] MalFamily: "Ge1Raqhg"

[*] MalScore: 10.0

[*] File Name: "rat_584a61540c449c0fe06a584239f03f88.exe"
[*] File Size: 593920
[*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
[*] SHA256: "3566467fb695bcf1321eb12fd43ccae242fcec0f9be9bf317d17b83f198ef856"
[*] MD5: "584a61540c449c0fe06a584239f03f88"
[*] SHA1: "5c85eba1ec5f1582f15dd6868a0997f8c803acfd"
[*] SHA512: "b833d17ccfbd071fbcde8c3b9015190b692ecfa200c732b613693f3e6b2bb73281f2161643b0cddc9eb403daaa142c1619c06947ec26acd94d8af83700dcae9c"
[*] CRC32: "DA0730E6"
[*] SSDEEP: "12288:O+aLhD8UPvQNR76oFAVdbOOvjELCnC+TUsBIDx6TleLPx:B0/P5YyLEOnCldKe"

[*] Process Execution: [
    "rat_584a61540c449c0fe06a584239f03f88.exe"
]

[*] Signatures Detected: [
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "The binary likely contains encrypted or compressed data.",
        "Details": [
            {
                "section": "name: .text, entropy: 7.62, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0008d000, virtual_size: 0x0008cef8"
            }
        ]
    },
    {
        "Description": "Installs itself for autorun at Windows startup",
        "Details": [
            {
                "file": "C:\\Windows\\win.ini"
            },
            {
                "file": "C:\\Windows\\win.ini"
            }
        ]
    },
    {
        "Description": "File has been identified by 25 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "Bkav": "HW32.Packed."
            },
            {
                "MicroWorld-eScan": "Gen:Heur.PonyStealer.Km0@ge1RaQhG"
            },
            {
                "FireEye": "Generic.mg.584a61540c449c0f"
            },
            {
                "McAfee": "Artemis!584A61540C44"
            },
            {
                "Symantec": "ML.Attribute.HighConfidence"
            },
            {
                "APEX": "Malicious"
            },
            {
                "Paloalto": "generic.ml"
            },
            {
                "Kaspersky": "Trojan.Win32.VBKryjetor.byiu"
            },
            {
                "BitDefender": "Gen:Heur.PonyStealer.Km0@ge1RaQhG"
            },
            {
                "Ad-Aware": "Gen:Heur.PonyStealer.Km0@ge1RaQhG"
            },
            {
                "Emsisoft": "Gen:Heur.PonyStealer.Km0@ge1RaQhG (B)"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "McAfee-GW-Edition": "BehavesLike.Win32.Generic.hc"
            },
            {
                "SentinelOne": "DFI - Suspicious PE"
            },
            {
                "Microsoft": "Trojan:Win32/Wacatac.B!ml"
            },
            {
                "ZoneAlarm": "Trojan.Win32.VBKryjetor.byiu"
            },
            {
                "GData": "Gen:Heur.PonyStealer.Km0@ge1RaQhG"
            },
            {
                "Acronis": "suspicious"
            },
            {
                "ALYac": "Gen:Heur.PonyStealer.Km0@ge1RaQhG"
            },
            {
                "MAX": "malware (ai score=82)"
            },
            {
                "TrendMicro-HouseCall": "TROJ_GEN.R015H07G219"
            },
            {
                "Rising": "Trojan.Injector!1.B459 (CLASSIC)"
            },
            {
                "Fortinet": "W32/GenKryptik.AWSE!tr"
            },
            {
                "Cybereason": "malicious.1ec5f1"
            },
            {
                "Qihoo-360": "HEUR/QVM03.0.424D.Malware.Gen"
            }
        ]
    }
]

[*] Started Service: []

[*] Executed Commands: [
    "\"C:\\Users\\user\\AppData\\Local\\Temp\\rat_584a61540c449c0fe06a584239f03f88.exe\""
]

[*] Mutexes: [
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1"
]

[*] Modified Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\~DFBBF206C8856399ED.TMP",
    "C:\\Windows\\win.ini"
]

[*] Deleted Files: []

[*] Modified Registry Keys: []

[*] Deleted Registry Keys: []

[*] DNS Communications: []

[*] Domains: []

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: []

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "_CIcos",
                        "address": "0x401000"
                    },
                    {
                        "name": "_adj_fptan",
                        "address": "0x401004"
                    },
                    {
                        "name": "__vbaVarMove",
                        "address": "0x401008"
                    },
                    {
                        "name": null,
                        "address": "0x40100c"
                    },
                    {
                        "name": "__vbaFreeVar",
                        "address": "0x401010"
                    },
                    {
                        "name": null,
                        "address": "0x401014"
                    },
                    {
                        "name": "__vbaStrVarMove",
                        "address": "0x401018"
                    },
                    {
                        "name": null,
                        "address": "0x40101c"
                    },
                    {
                        "name": "__vbaFreeVarList",
                        "address": "0x401020"
                    },
                    {
                        "name": "__vbaEnd",
                        "address": "0x401024"
                    },
                    {
                        "name": "_adj_fdiv_m64",
                        "address": "0x401028"
                    },
                    {
                        "name": "__vbaFreeObjList",
                        "address": "0x40102c"
                    },
                    {
                        "name": null,
                        "address": "0x401030"
                    },
                    {
                        "name": "_adj_fprem1",
                        "address": "0x401034"
                    },
                    {
                        "name": null,
                        "address": "0x401038"
                    },
                    {
                        "name": null,
                        "address": "0x40103c"
                    },
                    {
                        "name": null,
                        "address": "0x401040"
                    },
                    {
                        "name": "__vbaSetSystemError",
                        "address": "0x401044"
                    },
                    {
                        "name": "__vbaLenBstrB",
                        "address": "0x401048"
                    },
                    {
                        "name": "__vbaHresultCheckObj",
                        "address": "0x40104c"
                    },
                    {
                        "name": null,
                        "address": "0x401050"
                    },
                    {
                        "name": null,
                        "address": "0x401054"
                    },
                    {
                        "name": "_adj_fdiv_m32",
                        "address": "0x401058"
                    },
                    {
                        "name": null,
                        "address": "0x40105c"
                    },
                    {
                        "name": null,
                        "address": "0x401060"
                    },
                    {
                        "name": "__vbaAryDestruct",
                        "address": "0x401064"
                    },
                    {
                        "name": null,
                        "address": "0x401068"
                    },
                    {
                        "name": null,
                        "address": "0x40106c"
                    },
                    {
                        "name": null,
                        "address": "0x401070"
                    },
                    {
                        "name": "__vbaOnError",
                        "address": "0x401074"
                    },
                    {
                        "name": "__vbaObjSet",
                        "address": "0x401078"
                    },
                    {
                        "name": "_adj_fdiv_m16i",
                        "address": "0x40107c"
                    },
                    {
                        "name": "__vbaObjSetAddref",
                        "address": "0x401080"
                    },
                    {
                        "name": "_adj_fdivr_m16i",
                        "address": "0x401084"
                    },
                    {
                        "name": null,
                        "address": "0x401088"
                    },
                    {
                        "name": null,
                        "address": "0x40108c"
                    },
                    {
                        "name": null,
                        "address": "0x401090"
                    },
                    {
                        "name": "__vbaFpR8",
                        "address": "0x401094"
                    },
                    {
                        "name": "_CIsin",
                        "address": "0x401098"
                    },
                    {
                        "name": "__vbaErase",
                        "address": "0x40109c"
                    },
                    {
                        "name": null,
                        "address": "0x4010a0"
                    },
                    {
                        "name": "__vbaChkstk",
                        "address": "0x4010a4"
                    },
                    {
                        "name": "EVENT_SINK_AddRef",
                        "address": "0x4010a8"
                    },
                    {
                        "name": "__vbaGenerateBoundsError",
                        "address": "0x4010ac"
                    },
                    {
                        "name": "__vbaStrCmp",
                        "address": "0x4010b0"
                    },
                    {
                        "name": "__vbaVarTstEq",
                        "address": "0x4010b4"
                    },
                    {
                        "name": "__vbaAryConstruct2",
                        "address": "0x4010b8"
                    },
                    {
                        "name": "__vbaObjVar",
                        "address": "0x4010bc"
                    },
                    {
                        "name": "__vbaI2I4",
                        "address": "0x4010c0"
                    },
                    {
                        "name": null,
                        "address": "0x4010c4"
                    },
                    {
                        "name": "DllFunctionCall",
                        "address": "0x4010c8"
                    },
                    {
                        "name": null,
                        "address": "0x4010cc"
                    },
                    {
                        "name": "_adj_fpatan",
                        "address": "0x4010d0"
                    },
                    {
                        "name": null,
                        "address": "0x4010d4"
                    },
                    {
                        "name": null,
                        "address": "0x4010d8"
                    },
                    {
                        "name": "__vbaRedim",
                        "address": "0x4010dc"
                    },
                    {
                        "name": "EVENT_SINK_Release",
                        "address": "0x4010e0"
                    },
                    {
                        "name": null,
                        "address": "0x4010e4"
                    },
                    {
                        "name": "_CIsqrt",
                        "address": "0x4010e8"
                    },
                    {
                        "name": "EVENT_SINK_QueryInterface",
                        "address": "0x4010ec"
                    },
                    {
                        "name": "__vbaExceptHandler",
                        "address": "0x4010f0"
                    },
                    {
                        "name": "_adj_fprem",
                        "address": "0x4010f4"
                    },
                    {
                        "name": "_adj_fdivr_m64",
                        "address": "0x4010f8"
                    },
                    {
                        "name": null,
                        "address": "0x4010fc"
                    },
                    {
                        "name": null,
                        "address": "0x401100"
                    },
                    {
                        "name": "__vbaFPException",
                        "address": "0x401104"
                    },
                    {
                        "name": null,
                        "address": "0x401108"
                    },
                    {
                        "name": null,
                        "address": "0x40110c"
                    },
                    {
                        "name": null,
                        "address": "0x401110"
                    },
                    {
                        "name": "_CIlog",
                        "address": "0x401114"
                    },
                    {
                        "name": "__vbaErrorOverflow",
                        "address": "0x401118"
                    },
                    {
                        "name": "__vbaFileOpen",
                        "address": "0x40111c"
                    },
                    {
                        "name": null,
                        "address": "0x401120"
                    },
                    {
                        "name": "__vbaNew2",
                        "address": "0x401124"
                    },
                    {
                        "name": "__vbaInStr",
                        "address": "0x401128"
                    },
                    {
                        "name": null,
                        "address": "0x40112c"
                    },
                    {
                        "name": "_adj_fdiv_m32i",
                        "address": "0x401130"
                    },
                    {
                        "name": null,
                        "address": "0x401134"
                    },
                    {
                        "name": "_adj_fdivr_m32i",
                        "address": "0x401138"
                    },
                    {
                        "name": "__vbaStrCopy",
                        "address": "0x40113c"
                    },
                    {
                        "name": null,
                        "address": "0x401140"
                    },
                    {
                        "name": null,
                        "address": "0x401144"
                    },
                    {
                        "name": "__vbaDerefAry1",
                        "address": "0x401148"
                    },
                    {
                        "name": "_adj_fdivr_m32",
                        "address": "0x40114c"
                    },
                    {
                        "name": "_adj_fdiv_r",
                        "address": "0x401150"
                    },
                    {
                        "name": null,
                        "address": "0x401154"
                    },
                    {
                        "name": null,
                        "address": "0x401158"
                    },
                    {
                        "name": "__vbaVarTstNe",
                        "address": "0x40115c"
                    },
                    {
                        "name": "__vbaI4Var",
                        "address": "0x401160"
                    },
                    {
                        "name": "__vbaLateMemCall",
                        "address": "0x401164"
                    },
                    {
                        "name": "__vbaInStrB",
                        "address": "0x401168"
                    },
                    {
                        "name": "__vbaVarDup",
                        "address": "0x40116c"
                    },
                    {
                        "name": null,
                        "address": "0x401170"
                    },
                    {
                        "name": "__vbaStrComp",
                        "address": "0x401174"
                    },
                    {
                        "name": null,
                        "address": "0x401178"
                    },
                    {
                        "name": "__vbaVarLateMemCallLd",
                        "address": "0x40117c"
                    },
                    {
                        "name": "__vbaFpI4",
                        "address": "0x401180"
                    },
                    {
                        "name": "__vbaVarCopy",
                        "address": "0x401184"
                    },
                    {
                        "name": "_CIatan",
                        "address": "0x401188"
                    },
                    {
                        "name": "__vbaStrMove",
                        "address": "0x40118c"
                    },
                    {
                        "name": null,
                        "address": "0x401190"
                    },
                    {
                        "name": "__vbaCastObj",
                        "address": "0x401194"
                    },
                    {
                        "name": null,
                        "address": "0x401198"
                    },
                    {
                        "name": "_allmul",
                        "address": "0x40119c"
                    },
                    {
                        "name": null,
                        "address": "0x4011a0"
                    },
                    {
                        "name": "_CItan",
                        "address": "0x4011a4"
                    },
                    {
                        "name": null,
                        "address": "0x4011a8"
                    },
                    {
                        "name": "_CIexp",
                        "address": "0x4011ac"
                    },
                    {
                        "name": "__vbaFreeStr",
                        "address": "0x4011b0"
                    },
                    {
                        "name": "__vbaFreeObj",
                        "address": "0x4011b4"
                    }
                ],
                "dll": "MSVBVM60.DLL"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00098145",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x00098145",
        "icon_hash": null,
        "entrypoint": "0x00401504",
        "timestamp": "2010-02-01 15:23:11",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x0008d000",
                "entropy": "7.62",
                "raw_address": "0x00001000",
                "virtual_size": "0x0008cef8",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x0008e000",
                "size_of_data": "0x00001000",
                "entropy": "0.00",
                "raw_address": "0x0008e000",
                "virtual_size": "0x000045f0",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00093000",
                "size_of_data": "0x00002000",
                "entropy": "3.34",
                "raw_address": "0x0008f000",
                "virtual_size": "0x000010c0",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0008d8a4",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000028"
            },
            {
                "virtual_address": "0x00093000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x000010c0"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000238",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000020"
            },
            {
                "virtual_address": "0x00001000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x000001bc"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "43ee93d6d614c6b0ef9f3369b8929766",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 1,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "cryptbase.dll.SystemFunction036",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "oleaut32.dll.OleLoadPictureEx",
    "oleaut32.dll.DispCallFunc",
    "oleaut32.dll.LoadTypeLibEx",
    "oleaut32.dll.UnRegisterTypeLib",
    "oleaut32.dll.CreateTypeLib2",
    "oleaut32.dll.VarDateFromUdate",
    "oleaut32.dll.VarUdateFromDate",
    "oleaut32.dll.GetAltMonthNames",
    "oleaut32.dll.VarNumFromParseNum",
    "oleaut32.dll.VarParseNumFromStr",
    "oleaut32.dll.VarDecFromR4",
    "oleaut32.dll.VarDecFromR8",
    "oleaut32.dll.VarDecFromDate",
    "oleaut32.dll.VarDecFromI4",
    "oleaut32.dll.VarDecFromCy",
    "oleaut32.dll.VarR4FromDec",
    "oleaut32.dll.GetRecordInfoFromTypeInfo",
    "oleaut32.dll.GetRecordInfoFromGuids",
    "oleaut32.dll.SafeArrayGetRecordInfo",
    "oleaut32.dll.SafeArraySetRecordInfo",
    "oleaut32.dll.SafeArrayGetIID",
    "oleaut32.dll.SafeArraySetIID",
    "oleaut32.dll.SafeArrayCopyData",
    "oleaut32.dll.SafeArrayAllocDescriptorEx",
    "oleaut32.dll.SafeArrayCreateEx",
    "oleaut32.dll.VarFormat",
    "oleaut32.dll.VarFormatDateTime",
    "oleaut32.dll.VarFormatNumber",
    "oleaut32.dll.VarFormatPercent",
    "oleaut32.dll.VarFormatCurrency",
    "oleaut32.dll.VarWeekdayName",
    "oleaut32.dll.VarMonthName",
    "oleaut32.dll.VarAdd",
    "oleaut32.dll.VarAnd",
    "oleaut32.dll.VarCat",
    "oleaut32.dll.VarDiv",
    "oleaut32.dll.VarEqv",
    "oleaut32.dll.VarIdiv",
    "oleaut32.dll.VarImp",
    "oleaut32.dll.VarMod",
    "oleaut32.dll.VarMul",
    "oleaut32.dll.VarOr",
    "oleaut32.dll.VarPow",
    "oleaut32.dll.VarSub",
    "oleaut32.dll.VarXor",
    "oleaut32.dll.VarAbs",
    "oleaut32.dll.VarFix",
    "oleaut32.dll.VarInt",
    "oleaut32.dll.VarNeg",
    "oleaut32.dll.VarNot",
    "oleaut32.dll.VarRound",
    "oleaut32.dll.VarCmp",
    "oleaut32.dll.VarDecAdd",
    "oleaut32.dll.VarDecCmp",
    "oleaut32.dll.VarBstrCat",
    "oleaut32.dll.VarCyMulI4",
    "oleaut32.dll.VarBstrCmp",
    "ole32.dll.CoCreateInstanceEx",
    "ole32.dll.CLSIDFromProgIDEx",
    "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
    "user32.dll.GetSystemMetrics",
    "user32.dll.MonitorFromWindow",
    "user32.dll.MonitorFromRect",
    "user32.dll.MonitorFromPoint",
    "user32.dll.EnumDisplayMonitors",
    "user32.dll.GetMonitorInfoA",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGenRandom",
    "dwmapi.dll.DwmIsCompositionEnabled",
    "lpk.dll.LpkEditControl",
    "comctl32.dll.HIMAGELIST_QueryInterface",
    "comctl32.dll.DrawShadowText",
    "comctl32.dll.DrawSizeBox",
    "comctl32.dll.DrawScrollBar",
    "comctl32.dll.SizeBoxHwnd",
    "comctl32.dll.ScrollBar_MouseMove",
    "comctl32.dll.ScrollBar_Menu",
    "comctl32.dll.HandleScrollCmd",
    "comctl32.dll.DetachScrollBars",
    "comctl32.dll.AttachScrollBars",
    "comctl32.dll.CCSetScrollInfo",
    "comctl32.dll.CCGetScrollInfo",
    "comctl32.dll.CCEnableScrollBar",
    "comctl32.dll.QuerySystemGestureStatus",
    "uxtheme.dll.#49",
    "uxtheme.dll.CloseThemeData",
    "uxtheme.dll.DrawThemeBackground",
    "gdi32.dll.GetLayout",
    "gdi32.dll.GdiRealizationInfo",
    "gdi32.dll.FontIsLinked",
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegQueryInfoKeyW",
    "gdi32.dll.GetTextFaceAliasW",
    "advapi32.dll.RegEnumValueW",
    "advapi32.dll.RegCloseKey",
    "advapi32.dll.RegQueryValueExW",
    "gdi32.dll.GetFontAssocStatus",
    "advapi32.dll.RegQueryValueExA",
    "advapi32.dll.RegEnumKeyExW",
    "gdi32.dll.GdiIsMetaPrintDC",
    "ole32.dll.CoInitializeEx",
    "ole32.dll.CoUninitialize",
    "ole32.dll.CoRegisterInitializeSpy",
    "ole32.dll.CoRevokeInitializeSpy",
    "gdi32.dll.GetTextExtentExPointWPri",
    "kernel32.dll.NlsGetCacheUpdateCount",
    "kernel32.dll.GetCalendarInfoW",
    "kernel32.dll.EnumResourceTypesW",
    "kernel32.dll.HeapCreate",
    "kernel32.dll.HeapAlloc",
    "kernel32.dll.Sleep",
    "kernel32.dll.WriteProfileStringA",
    "ntdll.dll.NtProtectVirtualMemory",
    "kernel32.dll.CreateFileA",
    "kernel32.dll.WriteFile",
    "kernel32.dll.CloseHandle",
    "kernel32.dll.ReadFile",
    "kernel32.dll.GetFileSize",
    "kernel32.dll.UnmapViewOfFile",
    "kernel32.dll.VirtualProtectEx",
    "kernel32.dll.GetLongPathNameA",
    "kernel32.dll.TerminateProcess",
    "iphlpapi.dll.GetAdaptersInfo",
    "kernel32.dll.VirtualAllocEx",
    "kernel32.dll.CreateProcessW",
    "shell32.dll.ShellExecuteA",
    "advapi32.dll.RegCreateKeyExA",
    "advapi32.dll.RegSetValueExA",
    "kernel32.dll.WaitForDebugEvent",
    "kernel32.dll.ContinueDebugEvent",
    "kernel32.dll.DebugActiveProcessStop",
    "kernel32.dll.OutputDebugStringW"
]

[*] Static Analysis: {
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "_CIcos",
                        "address": "0x401000"
                    },
                    {
                        "name": "_adj_fptan",
                        "address": "0x401004"
                    },
                    {
                        "name": "__vbaVarMove",
                        "address": "0x401008"
                    },
                    {
                        "name": null,
                        "address": "0x40100c"
                    },
                    {
                        "name": "__vbaFreeVar",
                        "address": "0x401010"
                    },
                    {
                        "name": null,
                        "address": "0x401014"
                    },
                    {
                        "name": "__vbaStrVarMove",
                        "address": "0x401018"
                    },
                    {
                        "name": null,
                        "address": "0x40101c"
                    },
                    {
                        "name": "__vbaFreeVarList",
                        "address": "0x401020"
                    },
                    {
                        "name": "__vbaEnd",
                        "address": "0x401024"
                    },
                    {
                        "name": "_adj_fdiv_m64",
                        "address": "0x401028"
                    },
                    {
                        "name": "__vbaFreeObjList",
                        "address": "0x40102c"
                    },
                    {
                        "name": null,
                        "address": "0x401030"
                    },
                    {
                        "name": "_adj_fprem1",
                        "address": "0x401034"
                    },
                    {
                        "name": null,
                        "address": "0x401038"
                    },
                    {
                        "name": null,
                        "address": "0x40103c"
                    },
                    {
                        "name": null,
                        "address": "0x401040"
                    },
                    {
                        "name": "__vbaSetSystemError",
                        "address": "0x401044"
                    },
                    {
                        "name": "__vbaLenBstrB",
                        "address": "0x401048"
                    },
                    {
                        "name": "__vbaHresultCheckObj",
                        "address": "0x40104c"
                    },
                    {
                        "name": null,
                        "address": "0x401050"
                    },
                    {
                        "name": null,
                        "address": "0x401054"
                    },
                    {
                        "name": "_adj_fdiv_m32",
                        "address": "0x401058"
                    },
                    {
                        "name": null,
                        "address": "0x40105c"
                    },
                    {
                        "name": null,
                        "address": "0x401060"
                    },
                    {
                        "name": "__vbaAryDestruct",
                        "address": "0x401064"
                    },
                    {
                        "name": null,
                        "address": "0x401068"
                    },
                    {
                        "name": null,
                        "address": "0x40106c"
                    },
                    {
                        "name": null,
                        "address": "0x401070"
                    },
                    {
                        "name": "__vbaOnError",
                        "address": "0x401074"
                    },
                    {
                        "name": "__vbaObjSet",
                        "address": "0x401078"
                    },
                    {
                        "name": "_adj_fdiv_m16i",
                        "address": "0x40107c"
                    },
                    {
                        "name": "__vbaObjSetAddref",
                        "address": "0x401080"
                    },
                    {
                        "name": "_adj_fdivr_m16i",
                        "address": "0x401084"
                    },
                    {
                        "name": null,
                        "address": "0x401088"
                    },
                    {
                        "name": null,
                        "address": "0x40108c"
                    },
                    {
                        "name": null,
                        "address": "0x401090"
                    },
                    {
                        "name": "__vbaFpR8",
                        "address": "0x401094"
                    },
                    {
                        "name": "_CIsin",
                        "address": "0x401098"
                    },
                    {
                        "name": "__vbaErase",
                        "address": "0x40109c"
                    },
                    {
                        "name": null,
                        "address": "0x4010a0"
                    },
                    {
                        "name": "__vbaChkstk",
                        "address": "0x4010a4"
                    },
                    {
                        "name": "EVENT_SINK_AddRef",
                        "address": "0x4010a8"
                    },
                    {
                        "name": "__vbaGenerateBoundsError",
                        "address": "0x4010ac"
                    },
                    {
                        "name": "__vbaStrCmp",
                        "address": "0x4010b0"
                    },
                    {
                        "name": "__vbaVarTstEq",
                        "address": "0x4010b4"
                    },
                    {
                        "name": "__vbaAryConstruct2",
                        "address": "0x4010b8"
                    },
                    {
                        "name": "__vbaObjVar",
                        "address": "0x4010bc"
                    },
                    {
                        "name": "__vbaI2I4",
                        "address": "0x4010c0"
                    },
                    {
                        "name": null,
                        "address": "0x4010c4"
                    },
                    {
                        "name": "DllFunctionCall",
                        "address": "0x4010c8"
                    },
                    {
                        "name": null,
                        "address": "0x4010cc"
                    },
                    {
                        "name": "_adj_fpatan",
                        "address": "0x4010d0"
                    },
                    {
                        "name": null,
                        "address": "0x4010d4"
                    },
                    {
                        "name": null,
                        "address": "0x4010d8"
                    },
                    {
                        "name": "__vbaRedim",
                        "address": "0x4010dc"
                    },
                    {
                        "name": "EVENT_SINK_Release",
                        "address": "0x4010e0"
                    },
                    {
                        "name": null,
                        "address": "0x4010e4"
                    },
                    {
                        "name": "_CIsqrt",
                        "address": "0x4010e8"
                    },
                    {
                        "name": "EVENT_SINK_QueryInterface",
                        "address": "0x4010ec"
                    },
                    {
                        "name": "__vbaExceptHandler",
                        "address": "0x4010f0"
                    },
                    {
                        "name": "_adj_fprem",
                        "address": "0x4010f4"
                    },
                    {
                        "name": "_adj_fdivr_m64",
                        "address": "0x4010f8"
                    },
                    {
                        "name": null,
                        "address": "0x4010fc"
                    },
                    {
                        "name": null,
                        "address": "0x401100"
                    },
                    {
                        "name": "__vbaFPException",
                        "address": "0x401104"
                    },
                    {
                        "name": null,
                        "address": "0x401108"
                    },
                    {
                        "name": null,
                        "address": "0x40110c"
                    },
                    {
                        "name": null,
                        "address": "0x401110"
                    },
                    {
                        "name": "_CIlog",
                        "address": "0x401114"
                    },
                    {
                        "name": "__vbaErrorOverflow",
                        "address": "0x401118"
                    },
                    {
                        "name": "__vbaFileOpen",
                        "address": "0x40111c"
                    },
                    {
                        "name": null,
                        "address": "0x401120"
                    },
                    {
                        "name": "__vbaNew2",
                        "address": "0x401124"
                    },
                    {
                        "name": "__vbaInStr",
                        "address": "0x401128"
                    },
                    {
                        "name": null,
                        "address": "0x40112c"
                    },
                    {
                        "name": "_adj_fdiv_m32i",
                        "address": "0x401130"
                    },
                    {
                        "name": null,
                        "address": "0x401134"
                    },
                    {
                        "name": "_adj_fdivr_m32i",
                        "address": "0x401138"
                    },
                    {
                        "name": "__vbaStrCopy",
                        "address": "0x40113c"
                    },
                    {
                        "name": null,
                        "address": "0x401140"
                    },
                    {
                        "name": null,
                        "address": "0x401144"
                    },
                    {
                        "name": "__vbaDerefAry1",
                        "address": "0x401148"
                    },
                    {
                        "name": "_adj_fdivr_m32",
                        "address": "0x40114c"
                    },
                    {
                        "name": "_adj_fdiv_r",
                        "address": "0x401150"
                    },
                    {
                        "name": null,
                        "address": "0x401154"
                    },
                    {
                        "name": null,
                        "address": "0x401158"
                    },
                    {
                        "name": "__vbaVarTstNe",
                        "address": "0x40115c"
                    },
                    {
                        "name": "__vbaI4Var",
                        "address": "0x401160"
                    },
                    {
                        "name": "__vbaLateMemCall",
                        "address": "0x401164"
                    },
                    {
                        "name": "__vbaInStrB",
                        "address": "0x401168"
                    },
                    {
                        "name": "__vbaVarDup",
                        "address": "0x40116c"
                    },
                    {
                        "name": null,
                        "address": "0x401170"
                    },
                    {
                        "name": "__vbaStrComp",
                        "address": "0x401174"
                    },
                    {
                        "name": null,
                        "address": "0x401178"
                    },
                    {
                        "name": "__vbaVarLateMemCallLd",
                        "address": "0x40117c"
                    },
                    {
                        "name": "__vbaFpI4",
                        "address": "0x401180"
                    },
                    {
                        "name": "__vbaVarCopy",
                        "address": "0x401184"
                    },
                    {
                        "name": "_CIatan",
                        "address": "0x401188"
                    },
                    {
                        "name": "__vbaStrMove",
                        "address": "0x40118c"
                    },
                    {
                        "name": null,
                        "address": "0x401190"
                    },
                    {
                        "name": "__vbaCastObj",
                        "address": "0x401194"
                    },
                    {
                        "name": null,
                        "address": "0x401198"
                    },
                    {
                        "name": "_allmul",
                        "address": "0x40119c"
                    },
                    {
                        "name": null,
                        "address": "0x4011a0"
                    },
                    {
                        "name": "_CItan",
                        "address": "0x4011a4"
                    },
                    {
                        "name": null,
                        "address": "0x4011a8"
                    },
                    {
                        "name": "_CIexp",
                        "address": "0x4011ac"
                    },
                    {
                        "name": "__vbaFreeStr",
                        "address": "0x4011b0"
                    },
                    {
                        "name": "__vbaFreeObj",
                        "address": "0x4011b4"
                    }
                ],
                "dll": "MSVBVM60.DLL"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00098145",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x00098145",
        "icon_hash": null,
        "entrypoint": "0x00401504",
        "timestamp": "2010-02-01 15:23:11",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00001000",
                "size_of_data": "0x0008d000",
                "entropy": "7.62",
                "raw_address": "0x00001000",
                "virtual_size": "0x0008cef8",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".data",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
                "virtual_address": "0x0008e000",
                "size_of_data": "0x00001000",
                "entropy": "0.00",
                "raw_address": "0x0008e000",
                "virtual_size": "0x000045f0",
                "characteristics_raw": "0xc0000040"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00093000",
                "size_of_data": "0x00002000",
                "entropy": "3.34",
                "raw_address": "0x0008f000",
                "virtual_size": "0x000010c0",
                "characteristics_raw": "0x40000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x0008d8a4",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000028"
            },
            {
                "virtual_address": "0x00093000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x000010c0"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000238",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000020"
            },
            {
                "virtual_address": "0x00001000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x000001bc"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "43ee93d6d614c6b0ef9f3369b8929766",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 1,
        "versioninfo": []
    }
}