kutaki | a09fd5ecf91fcdc892b38fb7fb356a972134863f8b639f307d01d688d2e3c050

General

Target
a09fd5ecf91fcdc892b38fb7fb356a972134863f8b639f307d01d688d2e3c050
Size 755KB
Sample220708-y7dwqsffaj
SHA256 a09fd5ecf91fcdc892b38fb7fb356a972134863f8b639f307d01d688d2e3c050
MD5 645be265d5378cdfdda8a059a228b9a2
SHA1 2d7816de252f0881583fce21ccd4ef2e9bfe1dff
SHA512 55ccb2dfdf6776550bda7b476bdaac6ba6dac2d97f215d57b0e164544befbabb8732006cc1d8920452553f38dc453f497266d12d184bee79bb2ce3f5c7702f7a
SSDEEP 12288:TXJT7lzwFAvBzK61oORotpGPqlSpwhm4s5bsGSCs5:T5T7lzwFAvBzK61oORotrlSpnHuGE5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

File Explorer

a09fd5ecf91fcdc892b38fb7fb356a972134863f8b639f307d01d688d2e3c050

.exe 755KB

a09fd5ecf91fcdc892b38fb7fb356a972134863f8b639f307d01d688d2e3c050

IMPHASH bef99d8b3b42e241443cfaffb4e60861
SHA256 a09fd5ecf91fcdc892b38fb7fb356a972134863f8b639f307d01d688d2e3c050
MD5 645be265d5378cdfdda8a059a228b9a2
SHA1 2d7816de252f0881583fce21ccd4ef2e9bfe1dff
SHA512 55ccb2dfdf6776550bda7b476bdaac6ba6dac2d97f215d57b0e164544befbabb8732006cc1d8920452553f38dc453f497266d12d184bee79bb2ce3f5c7702f7a
SSDEEP 12288:TXJT7lzwFAvBzK61oORotpGPqlSpwhm4s5bsGSCs5:T5T7lzwFAvBzK61oORotrlSpnHuGE5
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable

Minor OS version

Major OS version

Entry point

16392

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaVarTstGt ord690 __vbaStrI2 _CIcos _adj_fptan __vbaHresultCheck __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLineInputStr __vbaStrVarMove __vbaLenBstr __vbaLateIdCall ord696 __vbaPut3 __vbaFreeVarList __vbaEnd _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord518 __vbaResume __vbaVarCmpNe __vbaStrCat ord660 __vbaWriteFile __vbaLsetFixstr __vbaRecDestruct __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar ord558 _adj_fdiv_m32 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock __vbaVarForInit ord593 __vbaExitProc ord300 ord594 __vbaStrLike __vbaOnError __vbaObjSet ord595 ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord306 __vbaStrFixstr __vbaBoolVar ord520 __vbaRefVarAry __vbaFpR8 __vbaBoolVarNull _CIsin __vbaErase ord631 ord709 __vbaVarCmpGt __vbaVargVarMove ord525 ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaGet3 __vbaStrCmp ord529 __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaObjVar __vbaI2I4 DllFunctionCall __vbaVarOr ord670 ord563 ord564 __vbaCastObjVar __vbaLbound _adj_fpatan ord567 __vbaR4Var __vbaFixstrConstruct __vbaLateIdCallLd __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaVarAnd __vbaObjIs EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 ord712 __vbaPrintFile __vbaStrToUnicode ord713 ord606 _adj_fprem _adj_fdivr_m64 ord607 __vbaI2Str ord608 ord716 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal __vbaVarCat ord535 __vbaI2Var __vbaLsetFixstrFree ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaR8Str __vbaVar2Vec ord648 ord570 __vbaNew2 __vbaInStr ord571 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord578 ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaVarCmpEq ord689 ord610 __vbaAryLock __vbaVarAdd __vbaVarDup __vbaStrToAnsi __vbaVarLateMemCallLd __vbaVarCopy __vbaFpI4 ord616 __vbaLateMemCallLd __vbaRecDestructAnsi ord617 _CIatan __vbaAryCopy __vbaStrMove __vbaCastObj __vbaForEachVar ord619 __vbaStrVarCopy __vbaR8IntI4 _allmul ord652 _CItan __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

Sharing