kutaki | SecuriteInfo[.]com[.]Variant[.]Tedy[.]136216[.]12172[.]8332 | Triage

Sharing

General

Target

SecuriteInfo.com.Variant.Tedy.136216.12172.8332
Size

1.4MB
MD5

8c17d000e5c2c8f7c4ac93dcbf8555ad
SHA1

423145d272a89dcc625be3f3d57df00d7481f569
SHA256

be5dca1c90e3ca0f7554a3c49d8588d182832e702b987dd323f5f3fdb5fcd990
SHA512

9bbdb934e506a6407c5c44df78458ec0e9c1f58edfbf6882dca3643b653a38bc649dd2f9c5f5afc51be04a45c2f9add64fa90a7e4e95ccfc976208747b4e9d58
SSDEEP

24576:mGe46D5tKERWpnhNjQlUPnGYI5aDM6swfmP/UDMS08Ckn3D:w46lgEshNjQmuYMao/wfmP/SA8NT

Score

10^/10

kutaki

Malware Config

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

Files

SecuriteInfo.com.Variant.Tedy.136216.12172.8332
.exe windows x86

029377c3caed32bf5d528787899935a6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord690
ord588
ord696
ord698
MethCallEngine
ord621
ord516
ord517
ord518
ord626
ord519
ord667
ord591
ord593
ord594
ord595
ord596
ord598
ord520
ord709
ord631
ord632
ord525
ord526
EVENT_SINK_AddRef
ord528
ord529
ord561
DllFunctionCall
ord563
ord670
ord564
ord567
ord568
ord569
EVENT_SINK_Release
ord600
ord601
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord710
ord711
ord712
ord606
ord713
ord714
ord607
ord608
ord531
ord716
ord717
ProcCallEngine
ord644
ord537
ord645
ord648
ord570
ord571
ord572
ord573
ord681
ord576
ord685
ord100
ord689
ord616
ord617
ord618
ord619
ord581

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 272KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ