kutaki | E-bill[.]exe | Triage

Resubmissions

11-07-2022 13:08

220711-qdebeahcgm 10

11-07-2022 03:42

220711-d9b5psgga9 10

Sharing

General

Target

E-bill.exe
Size

968KB
MD5

e8f5b21f536286d5fb65297300f4b11f
SHA1

c21a5f1668385d581d5ddebdd9907be4c961383a
SHA256

e296a3f9af1ee967a9a919495e2a12917dd4077d794a54e25b9e16c02854a74e
SHA512

21d16e637bdb9849656f949e46b6f37ad1b3f5338555f514804467a30b75c4f6e574ac6058b7d1ec8235c57aa16b190acb532f3905cb2bbbb9f1ad6c4362df7b
SSDEEP

6144:obIiwoxOTLTcO1S4GlA9jmHv/VCSY3hw9lMbk6u1QMS0y+lqiHTonWryFDYR4p:NizIs46A9jmP/uhu/yMS08CkntxYRE

Score

10^/10

kutaki

Malware Config

Signatures

Kutaki Executable 1 IoCs

Processes:

resource yara_rule

sample family_kutaki
Kutaki family
kutaki

Files

E-bill.exe
.exe windows x86

ca4f635ec97d724f1cd62e6df0037c4b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord690
ord696
ord698
MethCallEngine
ord516
ord518
ord626
ord519
ord660
ord667
ord591
ord593
ord594
ord595
ord596
ord598
ord520
ord631
ord525
ord632
ord526
EVENT_SINK_AddRef
ord528
ord529
ord561
DllFunctionCall
ord563
ord670
ord564
EVENT_SINK_Release
ord600
ord601
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
ord606
ord713
ord714
ord607
ord608
ord716
ord717
ProcCallEngine
ord644
ord537
ord645
ord648
ord570
ord572
ord573
ord681
ord576
ord685
ord100
ord689
ord616
ord617
ord618
ord619
ord650
ord581

Sections

.text
Size: 700KB - Virtual size: 698KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 264KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ