kutaki | 0be743ff728ebbccd5db21b81ce1d2a0ca990c0aaa1d4bb40af953b7dbab1d80

General

Target
0be743ff728ebbccd5db21b81ce1d2a0ca990c0aaa1d4bb40af953b7dbab1d80
Size 664KB
Sample220530-b3qcmshdg8
SHA256 0be743ff728ebbccd5db21b81ce1d2a0ca990c0aaa1d4bb40af953b7dbab1d80
MD5 2eef8b25420dbf133a3b9414bf51cb23
SHA1 f839d4f558d20e9a4d7964f59497641a5a097158
SHA512 bb468bf7c3c281dc34f4e27755d19fef455aee11e19e70b79284eaae001033e0f5d3e2f35c5d8023577a4e360a5d302eec6f8e8af9fd0d331426292deec16e3f
SSDEEP 12288:Zy3+dRFGz1cZCokF4LMqNJvOVGB7SLCY1J1kGl8V3eZsemDhkJQ:Zy3+21F4LMkEVG96r1/kGlVZshDhwQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

File Explorer

0be743ff728ebbccd5db21b81ce1d2a0ca990c0aaa1d4bb40af953b7dbab1d80

.exe 664KB

0be743ff728ebbccd5db21b81ce1d2a0ca990c0aaa1d4bb40af953b7dbab1d80

IMPHASH 40f2c42a8c7eaf24d3f07ef6dba6c943
SHA256 0be743ff728ebbccd5db21b81ce1d2a0ca990c0aaa1d4bb40af953b7dbab1d80
MD5 2eef8b25420dbf133a3b9414bf51cb23
SHA1 f839d4f558d20e9a4d7964f59497641a5a097158
SHA512 bb468bf7c3c281dc34f4e27755d19fef455aee11e19e70b79284eaae001033e0f5d3e2f35c5d8023577a4e360a5d302eec6f8e8af9fd0d331426292deec16e3f
SSDEEP 12288:Zy3+dRFGz1cZCokF4LMqNJvOVGB7SLCY1J1kGl8V3eZsemDhkJQ:Zy3+21F4LMkEVG96r1/kGlVZshDhwQ
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable

Minor OS version

Major OS version

Entry point

15924

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub __vbaStrI2 ord690 _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLineInputStr __vbaLenBstr __vbaLateIdCall __vbaStrVarMove ord696 __vbaEnd __vbaPut3 __vbaFreeVarList _adj_fdiv_m64 ord698 __vbaRaiseEvent ord621 __vbaNextEachVar __vbaFreeObjList ord516 ord517 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord518 ord626 ord519 __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock ord592 ord593 __vbaVarForInit __vbaExitProc ord300 ord594 __vbaStrLike __vbaObjSet __vbaOnError ord595 ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord599 ord306 __vbaForEachCollVar __vbaBoolVar __vbaStrFixstr ord520 ord521 __vbaRefVarAry __vbaFpR8 __vbaBoolVarNull _CIsin __vbaErase ord631 __vbaVarCmpGt __vbaVargVarMove ord632 ord525 __vbaChkstk __vbaCyVar ord526 __vbaFileClose EVENT_SINK_AddRef ord527 ord528 __vbaGenerateBoundsError ord529 __vbaGet3 __vbaStrCmp __vbaPutOwner3 __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaNextEachCollVar ord561 __vbaPrintObj __vbaObjVar __vbaI2I4 DllFunctionCall ord563 ord670 __vbaVarOr ord564 __vbaCastObjVar __vbaRedimPreserve __vbaLbound _adj_fpatan __vbaR4Var __vbaFixstrConstruct __vbaR4Cy __vbaLateIdCallLd __vbaR8Cy __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaLateIdCallSt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 ord712 __vbaStrToUnicode __vbaPrintFile ord713 _adj_fprem _adj_fdivr_m64 __vbaLateIdStAd __vbaFailedFriend ord714 ord607 ord608 ord716 __vbaFPException __vbaInStrVar ord717 __vbaGetOwner3 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaVar2Vec __vbaInStr ord570 ord648 __vbaR8Str __vbaNew2 ord571 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var ord689 __vbaVarCmpEq __vbaFpCy __vbaAryLock __vbaVarAdd __vbaStrComp __vbaStrToAnsi __vbaVarDup __vbaVerifyVarObj __vbaCheckTypeVar __vbaUnkVar __vbaFpI4 __vbaVarLateMemCallLd ord616 __vbaLateMemCallLd ord617 _CIatan ord618 __vbaAryCopy __vbaStrMove __vbaCastObj __vbaForEachVar ord619 __vbaStrVarCopy __vbaR8IntI4 _allmul __vbaLateIdSt _CItan __vbaNextEachCollAd __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing