Static task
static1
Behavioral task
behavioral1
Sample
3e44e780a76526026a6ddbcea40043e5fd098bf107b0b68f7d9d232eb72ae574.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3e44e780a76526026a6ddbcea40043e5fd098bf107b0b68f7d9d232eb72ae574.exe
Resource
win10v2004-20220414-en
General
-
Target
3e44e780a76526026a6ddbcea40043e5fd098bf107b0b68f7d9d232eb72ae574
-
Size
626KB
-
MD5
d2b8bfc68681f6e58838eff7a2cb33c0
-
SHA1
1c365788f6d248efea2a1a7f574efd610866deff
-
SHA256
3e44e780a76526026a6ddbcea40043e5fd098bf107b0b68f7d9d232eb72ae574
-
SHA512
6eeb7aa28dd1a038d8cf87b50c7bc46496cbb6e0b2181ea01bf9b0c0b3601229f84845a6025a21357b2fede93ac34ead37fd96809b0f914f89cae7ca4f43a6dc
-
SSDEEP
12288:OPt1JuG9HnPS0FIbzDbhFWp6ZCBbkGBMbxEF:+tNRK1DFwpdkGBnF
Malware Config
Signatures
Files
-
3e44e780a76526026a6ddbcea40043e5fd098bf107b0b68f7d9d232eb72ae574.exe windows x86
f3591e5f470ecb29a26df96ff2d82e31
Code Sign
01Certificate
IssuerCN=Akeo Consulting (http://akeo.ie),O=Secunia,C=AUNot Before15-10-2018 07:19Not After14-10-2023 07:19SubjectCN=Akeo Consulting (http://akeo.ie),O=Secunia,C=AU2b:40:da:e9:80:15:12:21:24:bb:14:76:97:42:17:8e:ed:cc:ac:81:b4:e9:5f:1d:29:6a:1e:92:62:4b:1e:7fSigner
Actual PE Digest2b:40:da:e9:80:15:12:21:24:bb:14:76:97:42:17:8e:ed:cc:ac:81:b4:e9:5f:1d:29:6a:1e:92:62:4b:1e:7fDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Akeo Consulting (http://akeo.ie),O=Secunia,C=AU30-06-2022 15:34 Valid: false
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaCyMul
__vbaStrVarMove
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
ord519
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord521
__vbaFPFix
_CIsin
ord631
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
__vbaVarTstEq
__vbaObjVar
DllFunctionCall
ord563
ord671
__vbaCastObjVar
__vbaLbound
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
ord713
_adj_fprem
_adj_fdivr_m64
ord609
__vbaFPException
__vbaDateVar
_CIlog
__vbaErrorOverflow
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
ord610
__vbaVarAdd
__vbaLateMemCall
__vbaStrToAnsi
ord616
__vbaVarLateMemCallLd
__vbaLateMemCallLd
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
ord618
__vbaR8IntI4
ord650
_allmul
ord544
ord545
_CItan
ord546
_CIexp
__vbaFreeObj
__vbaFreeStr
Sections
.text Size: 596KB - Virtual size: 593KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ