kutaki | 3e6593faa630ec2c87ff8406f08264bb055982363400fddeaca502b0019ce6fd

General

Target
3e6593faa630ec2c87ff8406f08264bb055982363400fddeaca502b0019ce6fd
Size 568KB
Sample220701-jd1q3sabal
SHA256 3e6593faa630ec2c87ff8406f08264bb055982363400fddeaca502b0019ce6fd
MD5 609b31697442f224deb7fcd4170e8fd3
SHA1 11aed89fd1a0141fcc4626c1411239e5afe6ee8c
SHA512 aeb9d03cc8feab950ddb36ffab3e68a2eab9fd31ab4da01236ee8e539d4078ac92d28ef7245a346a331324cd3aea20f3f18322f8371153ca93ac4b5c94aa724c
SSDEEP 12288:TV4gmym7HFTQOlxtnp+jOuRFQGSPI5eLXg:a17lxijO+FQGmI5eLXg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

File Explorer

3e6593faa630ec2c87ff8406f08264bb055982363400fddeaca502b0019ce6fd

.exe 568KB

3e6593faa630ec2c87ff8406f08264bb055982363400fddeaca502b0019ce6fd

IMPHASH 22fca3b6fba6227e081e0f4c6a4aa597
SHA256 3e6593faa630ec2c87ff8406f08264bb055982363400fddeaca502b0019ce6fd
MD5 609b31697442f224deb7fcd4170e8fd3
SHA1 11aed89fd1a0141fcc4626c1411239e5afe6ee8c
SHA512 aeb9d03cc8feab950ddb36ffab3e68a2eab9fd31ab4da01236ee8e539d4078ac92d28ef7245a346a331324cd3aea20f3f18322f8371153ca93ac4b5c94aa724c
SSDEEP 12288:TV4gmym7HFTQOlxtnp+jOuRFQGSPI5eLXg:a17lxijO+FQGmI5eLXg
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable

Minor OS version

Major OS version

Entry point

13836

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub __vbaStrI2 ord690 _CIcos _adj_fptan __vbaHresultCheck __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLateIdCall __vbaStrVarMove __vbaLenBstr ord696 __vbaPut3 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 ord698 __vbaPut4 __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord518 ord626 ord519 __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat __vbaLsetFixstr ord553 __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock ord593 __vbaExitProc __vbaVarForInit ord594 __vbaFileCloseAll __vbaObjSet ord595 __vbaOnError ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaForEachCollVar __vbaStrFixstr ord520 __vbaBoolVarNull __vbaRefVarAry __vbaFpR8 _CIsin __vbaErase ord631 ord524 __vbaVarCmpGt __vbaVargVarMove ord632 ord525 __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaStrCmp __vbaGet3 ord529 __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaNextEachCollVar ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord563 __vbaVarOr ord670 ord564 __vbaLbound _adj_fpatan __vbaFixstrConstruct __vbaLateIdCallLd __vbaR8Cy __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 ord712 __vbaPrintFile __vbaStrToUnicode ord713 _adj_fprem _adj_fdivr_m64 ord714 ord607 ord608 ord716 __vbaFPException __vbaInStrVar ord717 __vbaStrVarVal __vbaUbound __vbaVarCat ord535 __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaVar2Vec __vbaR8Str ord648 ord570 __vbaNew2 __vbaInStr _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaVarCmpEq ord689 __vbaFpCy ord610 __vbaAryLock __vbaVarAdd __vbaStrComp ord612 __vbaStrToAnsi __vbaVarDup __vbaFpI4 __vbaVarLateMemCallLd ord616 __vbaLateMemCallLd ord617 _CIatan __vbaCastObj ord618 __vbaAryCopy __vbaStrMove __vbaForEachVar ord619 __vbaStrVarCopy __vbaR8IntI4 ord542 _allmul ord545 _CItan __vbaNextEachCollAd __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

Sharing