File name:

Visual Basic 6 Portable.exe

Full analysis: https://app.any.run/tasks/d4cd63c6-9bc6-4e53-a176-f1bf257040d9
Verdict: No threats detected
Analysis date: April 12, 2018, 13:37:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

FA7F4C0C8DB7351B7D2A43ED96F01E42

SHA1:

CF7C0DC9ECA9FF322072D7A8753E6672D65F7CA1

SHA256:

BFD56403A87D93C96F5DD7F175DE276A272C6C78AE2AA8A379C56175A29C3BAE

SSDEEP:

98304:m85pJdgrGxVnbcyVzD2GMMrUirHlbj8QKsMkVd4vTIVPnuIqhgGeHUkYEfg3ROqK:v+EkMPrHlbo/k37VPnuXhgT0kYEfDACN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • autorun.exe (PID: 2340)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Loads rich edit control libraries

      • Visual Basic 6 Portable.exe (PID: 1516)

    • Dropped object may contain URL's

      • Visual Basic 6 Portable.exe (PID: 1516)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | WinRAR Self Extracting archive (94.8)
.scr | Windows screen saver (2.3)
.dll | Win32 Dynamic Link Library (generic) (1.2)
.exe | Win32 Executable (generic) (0.8)
.exe | Generic Win/DOS Executable (0.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2006:08:04 20:28:08+02:00
PEType: PE32
LinkerVersion: 5
CodeSize: 77824
InitializedDataSize: 99840
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 04-Aug-2006 18:28:08
Detected languages:
  • Process Default Language
  • Russian - Russia

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000200

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 04-Aug-2006 18:28:08
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00013000
0x00012E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.46788
.data
0x00014000
0x00007000
0x00000A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.75622
.idata
0x0001B000
0x00001000
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.05399
.rsrc
0x0001C000
0x00016ACC
0x00016C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.58002

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.10885
531
Latin 1 / Western European
Russian - Russia
RT_MANIFEST
2
2.30303
296
Latin 1 / Western European
Process Default Language
RT_ICON
7
3.24143
556
Latin 1 / Western European
Russian - Russia
RT_STRING
8
3.28574
946
Latin 1 / Western European
Russian - Russia
RT_STRING
9
3.04375
530
Latin 1 / Western European
Russian - Russia
RT_STRING
10
3.15563
638
Latin 1 / Western European
Russian - Russia
RT_STRING
100
2.37086
34
Latin 1 / Western European
Process Default Language
RT_GROUP_ICON
101
6.50685
84602
Latin 1 / Western European
Process Default Language
RT_BITMAP
ASKNEXTVOL
3.42532
642
Latin 1 / Western European
Russian - Russia
RT_DIALOG
GETPASSWORD1
3.29928
314
Latin 1 / Western European
Russian - Russia
RT_DIALOG

Imports

ADVAPI32.DLL
COMCTL32.DLL
COMDLG32.DLL
GDI32.DLL
KERNEL32.DLL
OLE32.DLL
SHELL32.DLL
USER32.DLL
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start visual basic 6 portable.exe autorun.exe no specs visual basic 6 portable.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1516"C:\Users\admin\AppData\Local\Temp\Visual Basic 6 Portable.exe" C:\Users\admin\AppData\Local\Temp\Visual Basic 6 Portable.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\visual basic 6 portable.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
2164"C:\Users\admin\AppData\Local\Temp\Visual Basic 6 Portable.exe" C:\Users\admin\AppData\Local\Temp\Visual Basic 6 Portable.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\visual basic 6 portable.exe
c:\systemroot\system32\ntdll.dll
2340"C:\Users\admin\AppData\Local\Temp\RarSFX0\autorun.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\autorun.exe—Visual Basic 6 Portable.exe
User:
admin
Integrity Level:
HIGH
Description:
AutoPlay Application
Exit code:
0
Version:
6.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\autorun.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
405
Read events
399
Write events
6
Delete events
0

Modification events

(PID) Process:(1516) Visual Basic 6 Portable.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1516) Visual Basic 6 Portable.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2340) autorun.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\DirectSound\Speaker Configuration
Operation:writeName:Speaker Configuration
Value:
4
Executable files
15
Suspicious files
1
Text files
8
Unknown types
4

Dropped files

PID
Process
Filename
Type
1516Visual Basic 6 Portable.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\AutoPlay\Docs\Portable.VB6\Link.exeexecutable
MD5:97161E066763A3C5877285BF03FEB3C8
SHA256:08D3A4C9701C8F6C871B2C48BD74D07422AA1F86E5D9A4DDB2C9BD6A88B857E7
1516Visual Basic 6 Portable.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\AutoPlay\Audio\High1.oggogg
MD5:FC2A595F574B1EAD82A6DCF06492C985
SHA256:EE9A4903A8DF90EFF4C5B65A8073E564A3581CF73772A72EB82396E69932E769
1516Visual Basic 6 Portable.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\AutoPlay\Audio\Click1.oggogg
MD5:93270C4FA492E4E4EDEE872A2B961DDE
SHA256:25D49CBBD65D48AD462455F1143F73EE997DF8F747E7D2213DAAB18E321C028B
1516Visual Basic 6 Portable.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\AutoPlay\Docs\Portable.VB6\Vb6.olbtlb
MD5:376F14DCD409160260FDF98B20FB12DC
SHA256:4109EE488C9E930F8884280526B4C36FFC7CEE03329CAC6A9B8F5864B15C8453
1516Visual Basic 6 Portable.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\AutoPlay\Docs\Portable.VB6\Vbaexe6.libobj
MD5:242E8E0E0E4BE129D925C05049EAE377
SHA256:61E322A4885F63FEA756066F769168D0E7E1B4F99E13791141EF324D8B9F13A0
1516Visual Basic 6 Portable.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\AutoPlay\Icons\ico.icoimage
MD5:BC05AFB5FF4CEBA33D478FF49F7AF788
SHA256:961BE1877BC7D947855ECE5D28FDB1CF7FCE9801E12364EB16B2ADAD20F7A8B1
1516Visual Basic 6 Portable.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\AutoPlay\Docs\Portable.VB6\Msvcrt.dllexecutable
MD5:242932CACF55F067793CAD819C8C73EE
SHA256:FB6260B07C05BDBCB6928156DA514BE5B6B69F095B335692BA46C561D85BD5F8
1516Visual Basic 6 Portable.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\AutoPlay\Docs\Portable.VB6\Vb6.exeexecutable
MD5:C2F73A932000037A4B07C9B7F42E1027
SHA256:5E1D024E767E28A376327287F015B1E0DF0FC8614DA4811ED738C697398B2D4D
1516Visual Basic 6 Portable.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\AutoPlay\Docs\VbPortable6.regtext
MD5:D13A3AE689A1D1C67E1DB3F00DEB0BD5
SHA256:E76AE641CEA1FD985C674DCB5239818226583933113B2ACC9642E5106129CEF3
1516Visual Basic 6 Portable.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\AutoPlay\Docs\Portable.VB6\Mso97rt.dllexecutable
MD5:D3995767AC60B6D91E34F6C4900C0B1F
SHA256:2AC11B0EE5E980E4B7A9722F4D8A0C9299E23CC273010F0FF00411724B579691
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
teredo.ipv6.microsoft.com
  • —
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Visual Basic 6 Portable.exe