GetMsgCallFromVB6
InjectDllCallFromVB6
UnmapDllCallFromVB6
Static task
static1
Behavioral task
behavioral1
Sample
PT2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
PT2.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
ho tro.exe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
ho tro.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
hotro.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
hotro.dll
Resource
win10v2004-20221111-en
Target
a24f2481ff62eeb9226fef4ea4178e891ba7044805e01fa539edf31dc0616c73
Size
1.9MB
MD5
0a2bfb65a98d2da1dbdcb4c7f89bfef2
SHA1
395f0e6f36c385f6629a15b767eabdbc8de4c36c
SHA256
a24f2481ff62eeb9226fef4ea4178e891ba7044805e01fa539edf31dc0616c73
SHA512
130c0364c00de3147bd1ef5ffa38fcd315c5168256dabca4a2eafd91e50aa2c1b1f45589b3a55e81a129ade68d33d2d60dbbf4cfa5dbe1120def82c00222f5a9
SSDEEP
49152:zjeMB2LuUHDsc4EsX2G2S8Khaji4dY6h5gdl/6p+S48ZW6:zjeM0LXHDl4Esb2Etz6gdcoSW6
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
lstrcpyW
LoadLibraryW
GetModuleFileNameW
GetLastError
HeapFree
HeapAlloc
HeapReAlloc
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LocalFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
CloseHandle
lstrlenW
GetModuleHandleW
GetProcAddress
InterlockedIncrement
WideCharToMultiByte
SendMessageW
wsprintfW
FindWindowW
SHGetSpecialFolderPathW
SetSecurityInfo
SetEntriesInAclW
AllocateAndInitializeSid
GetSecurityInfo
FreeSid
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
ord690
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
ord621
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
_adj_fprem1
__vbaRecAnsiToUni
__vbaCopyBytes
__vbaStrCat
__vbaError
ord660
__vbaLsetFixstr
__vbaRecDestruct
__vbaSetSystemError
__vbaLenBstrB
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaVarIndexLoadRefLock
__vbaVarForInit
ord593
__vbaExitProc
ord595
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaVarIndexLoad
ord520
__vbaForEachCollVar
__vbaBoolVarNull
__vbaRefVarAry
_CIsin
ord631
__vbaErase
ord525
ord632
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaStrCmp
__vbaVarTstEq
__vbaAryConstruct2
ord561
__vbaNextEachCollVar
DllFunctionCall
__vbaVarLateMemSt
__vbaFpUI1
__vbaCastObjVar
__vbaLbound
__vbaRedimPreserve
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaStrR8
__vbaRedim
__vbaUI1ErrVar
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord601
_CIsqrt
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaExceptHandler
ord711
ord712
__vbaInputFile
__vbaStrToUnicode
__vbaPrintFile
_adj_fprem
_adj_fdivr_m64
ord714
ord608
__vbaFPException
ord717
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
__vbaVarCat
ord536
__vbaI2Var
ord644
ord537
ord645
_CIlog
__vbaFileOpen
__vbaVar2Vec
__vbaInStr
__vbaVarLateMemCallLdRf
ord648
ord570
__vbaNew2
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaStrCopy
ord573
ord681
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord100
ord579
__vbaI4Var
__vbaVarCmpEq
ord689
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
ord613
__vbaFpI2
__vbaFpI4
ord616
__vbaVarCopy
ord617
_CIatan
__vbaI2ErrVar
__vbaAryCopy
ord618
__vbaStrMove
__vbaCastObj
__vbaStrVarCopy
ord619
_allmul
__vbaLateIdSt
_CItan
__vbaFPInt
__vbaUI1Var
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaMidStmtBstr
__vbaRecAssign
__vbaFreeStr
__vbaFreeObj
ord581
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
DisableThreadLibraryCalls
VirtualProtect
FreeLibrary
LoadLibraryA
GetModuleFileNameA
CloseHandle
RtlUnwind
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
IsWindow
GetWindowThreadProcessId
SetWindowsHookExA
SendMessageA
GetAsyncKeyState
CallWindowProcA
UnhookWindowsHookEx
SetWindowLongA
CallNextHookEx
RegisterWindowMessageA
GetMsgCallFromVB6
InjectDllCallFromVB6
UnmapDllCallFromVB6
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ