kutaki | SecuriteInfo[.]com[.]Trojan[.]VB[.]OKD[.]27609[.]6648 | Triage

Sharing

General

Target

SecuriteInfo.com.Trojan.VB.OKD.27609.6648
Size

1.7MB
MD5

4ac806d9430e0022b72ca556c973b2be
SHA1

335796ac05bbfe658d488d72bf6fde6616743772
SHA256

5700788b88c1da1c95992a8d716a93013296fba1933c6d238ed01ad6d05b2690
SHA512

5b66f1c6e835358d440c191ac87c71e15874885580341ba78d72adc6097fb5f35ccece5eb5ba27b04e772f3deb3be0dd5d890c6e075a88585b2854c0cdfd5cb1
SSDEEP

24576:ie46D5tKERWpnhNjQlUPnGYI5aDMzdtZGL8+tUtfmP/UDMS08Ckn3N:V46lgEshNjQmuYMaozxGotfmP/SA8Nd

Score

10^/10

kutaki

Malware Config

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

Files

SecuriteInfo.com.Trojan.VB.OKD.27609.6648
.exe windows x86

67f310695ece8f1856c07ea3008696c1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord690
ord696
ord698
MethCallEngine
ord516
ord518
ord626
ord519
ord667
ord591
ord593
ord594
ord595
ord596
ord598
ord520
ord631
ord632
ord525
ord526
EVENT_SINK_AddRef
ord528
ord529
ord561
DllFunctionCall
ord563
ord670
ord564
EVENT_SINK_Release
ord600
ord601
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
ord713
ord714
ord607
ord608
ord716
ord717
ProcCallEngine
ord644
ord537
ord645
ord648
ord570
ord573
ord681
ord576
ord685
ord100
ord689
ord616
ord617
ord618
ord619
ord581

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 388KB - Virtual size: 386KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ