fa6983c115c33071019401a5834168290aa5e9ae0d965c84ca94a052a0514d7e

Sharing

Copy URL

Twitter E-mail

Reason

config extraction: GuloaderBin: guloader: invalid shellcode

General

Target

fa6983c115c33071019401a5834168290aa5e9ae0d965c84ca94a052a0514d7e
Size

2.5MB
MD5

a85c8f8fef95e8f66bfce306d9ba4ca0
SHA1

f0f32629881f38091a1b4e4780a262151ab80419
SHA256

fa6983c115c33071019401a5834168290aa5e9ae0d965c84ca94a052a0514d7e
SHA512

995d46875256301ac5436ff406c72134904e9f68d8d38bddde38d42bd955dec8c8fb141399acac42e3fab8db41eddfac287aec05ba77e219c8875f91885ceb78
SSDEEP

12288:H6TpJRhYeJc4lwe/lOBHGdeOV4xurxXRV+LEdI1Y/yVQcpGLkLsxvoysHszczt5q:IRhK4lwedOBmQ8r7Qu7zdwLs9wSit4

Score

N/A

Malware Config

Signatures

Files

fa6983c115c33071019401a5834168290aa5e9ae0d965c84ca94a052a0514d7e
.exe windows x86

793f63c91f1f377299ec0efda58ba503

Code Sign

01
Certificate

Issuer

CN=Internal Build Number\,92881,O=LegalTrademarks Native Instruments Nanosystems S.r.l,C=CH

Not Before

21-10-2018 07:47

Not After

20-10-2023 07:47

Subject

CN=Internal Build Number\,92881,O=LegalTrademarks Native Instruments Nanosystems S.r.l,C=CH

13:eb:be:c5:92:91:4d:f4:b3:cf:6e:54:a0:35:22:ab:cc:16:05:65
Signer

Actual PE Digest

13:eb:be:c5:92:91:4d:f4:b3:cf:6e:54:a0:35:22:ab:cc:16:05:65

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Internal Build Number\,92881,O=LegalTrademarks Native Instruments Nanosystems S.r.l,C=CH

30-06-2022 15:35
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaCyForInit
_CIcos
_adj_fptan
ord697
_adj_fdiv_m64
ord516
_adj_fprem1
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
_CIsin
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaCyI2
__vbaAryConstruct2
__vbaCyI4
DllFunctionCall
__vbaCySub
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaFpCmpCy
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaGetOwner3
__vbaCyForNext
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
__vbaInStr
__vbaR8Str
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaStrToAnsi
ord616
__vbaFpI4
_CIatan
__vbaStrMove
__vbaI4Cy
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

Errors

General

Malware Config

Signatures

Files

793f63c91f1f377299ec0efda58ba503

Code Sign

01Certificate

13:eb:be:c5:92:91:4d:f4:b3:cf:6e:54:a0:35:22:ab:cc:16:05:65Signer

Signature Validations

Verification

30-06-2022 15:35 Valid: false

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 16KB - Virtual size: 14KB

01
Certificate

13:eb:be:c5:92:91:4d:f4:b3:cf:6e:54:a0:35:22:ab:cc:16:05:65
Signer

30-06-2022 15:35
Valid: false

.text
Size: 2.5MB - Virtual size: 2.5MB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 16KB - Virtual size: 14KB