kutaki | eff15e66863ace3fd44f4fa3fdbe15a15d29b750efe97224134287e097ada5a0

General

Target
eff15e66863ace3fd44f4fa3fdbe15a15d29b750efe97224134287e097ada5a0
Size 816KB
Sample220731-2mvwasbdh5
SHA256 eff15e66863ace3fd44f4fa3fdbe15a15d29b750efe97224134287e097ada5a0
MD5 91b01051c2b3fbb0507e76ec0bb8f329
SHA1 49a1b1c6b58e29f842e54a4f03e5330b7f818fb6
SHA512 86f2d4941e1d779247c7929d0dd87bc4197332ce4ef33fbb0baa85f1476e78c5dd599c454ad45edfd39ccf928e6a42620c6b594af473845f296e9496376942eb
SSDEEP 24576:HD7afb2MJMJkmryhVG96r1/kGlVZshDhwp:HD7aikHhU9E19lPshwp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

File Explorer

eff15e66863ace3fd44f4fa3fdbe15a15d29b750efe97224134287e097ada5a0

.exe 816KB

eff15e66863ace3fd44f4fa3fdbe15a15d29b750efe97224134287e097ada5a0

IMPHASH d75ca552229ff10b4dd303500f55da45
SHA256 eff15e66863ace3fd44f4fa3fdbe15a15d29b750efe97224134287e097ada5a0
MD5 91b01051c2b3fbb0507e76ec0bb8f329
SHA1 49a1b1c6b58e29f842e54a4f03e5330b7f818fb6
SHA512 86f2d4941e1d779247c7929d0dd87bc4197332ce4ef33fbb0baa85f1476e78c5dd599c454ad45edfd39ccf928e6a42620c6b594af473845f296e9496376942eb
SSDEEP 24576:HD7afb2MJMJkmryhVG96r1/kGlVZshDhwp:HD7aikHhU9E19lPshwp
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable

Minor OS version

Major OS version

Entry point

17664

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarTstGt __vbaVarSub __vbaStrI2 ord690 _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaLateIdCall ord696 __vbaEnd __vbaPut3 __vbaFreeVarList _adj_fdiv_m64 ord698 EVENT_SINK_Invoke __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord518 ord626 ord519 __vbaResume __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat __vbaLsetFixstr ord660 __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar ord667 Zombie_GetTypeInfo __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock __vbaForEachCollObj __vbaExitProc ord593 __vbaVarForInit ord594 __vbaStrLike __vbaOnError __vbaObjSet ord595 ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord304 __vbaVarIndexLoad ord598 __vbaForEachCollVar __vbaStrFixstr ord520 __vbaVarTstLt __vbaBoolVarNull __vbaRefVarAry __vbaFpR8 _CIsin __vbaErase ord631 __vbaNextEachCollObj __vbaVarCmpGt __vbaVargVarMove ord632 ord525 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError ord529 __vbaGet3 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 ord560 __vbaNextEachCollVar ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord563 __vbaVarOr ord670 ord564 __vbaCastObjVar __vbaLbound _adj_fpatan __vbaFixstrConstruct __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaR8Cy __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt ord310 __vbaVarAnd __vbaObjIs EVENT_SINK_QueryInterface __vbaVarMul __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord312 ord711 ord712 __vbaStrToUnicode __vbaPrintFile ord606 ord713 _adj_fprem _adj_fdivr_m64 __vbaLateIdStAd __vbaVarDiv ord714 ord607 ord608 ord716 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaDateVar __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaVar2Vec __vbaInStr ord570 ord648 __vbaR8Str __vbaNew2 __vbaVarInt _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaR8Var __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaVarCmpEq ord689 ord610 __vbaFpCy __vbaAryLock __vbaVarAdd __vbaLateMemCall __vbaFreeVarg __vbaStrComp __vbaStrToAnsi __vbaVarDup __vbaVerifyVarObj __vbaVarCopy __vbaFpI4 __vbaVarLateMemCallLd ord616 __vbaLateMemCallLd ord617 _CIatan __vbaCastObj ord618 __vbaAryCopy __vbaStrMove __vbaForEachVar ord619 __vbaStrVarCopy __vbaR8IntI4 ord650 _allmul __vbaLateIdSt _CItan __vbaNextEachCollAd __vbaFPInt __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

Sharing