8f7ebea65a4772dfabe282220aa72d333257d10cd46b783b269564a1a73f1b04

Reason

config extraction: GuloaderBin: guloader: invalid shellcode

General

Target

8f7ebea65a4772dfabe282220aa72d333257d10cd46b783b269564a1a73f1b04
Size

144KB
MD5

5ebc19bb8107e1733d11128c5636b640
SHA1

29fd39a05421760d09137a6a5fe5459ae6aaa606
SHA256

8f7ebea65a4772dfabe282220aa72d333257d10cd46b783b269564a1a73f1b04
SHA512

1f8316d7931ac1d9fe67fa52a2d5ba65e693ace7121bb1aaf246b97f3dc948f30635ad058df91acf69eeb4e619694918e6a5557e2aab8687ead9677cad27c5ef
SSDEEP

3072:juWg6LFMs2U1V2rG55HC+4K0CON7MnHuo4nC3:6W1FM+nHzxOe4e

Score

N/A

Malware Config

Signatures

Files

8f7ebea65a4772dfabe282220aa72d333257d10cd46b783b269564a1a73f1b04
.exe windows x86

1cec45f658d4bfa06def0b907f64cfc8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
__vbaStrI2
__vbaNextEachAry
_CIcos
_adj_fptan
__vbaVarMove
__vbaCyMul
__vbaFreeVar
__vbaAryMove
__vbaStrVarMove
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
ord698
ord513
__vbaNextEachVar
_adj_fprem1
__vbaStrCat
__vbaError
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaOnError
__vbaCyAdd
_adj_fdiv_m16i
_adj_fdivr_m16i
__vbaVarIndexLoad
__vbaBoolVar
__vbaBoolVarNull
_CIsin
__vbaErase
__vbaVarZero
__vbaChkstk
__vbaCyVar
__vbaI2Cy
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaCyI2
__vbaAryConstruct2
__vbaCyI4
__vbaDateR8
__vbaI2I4
DllFunctionCall
ord670
__vbaCySub
__vbaFpUI1
__vbaRedimPreserve
_adj_fpatan
__vbaRedim
__vbaCyUI1
EVENT_SINK_Release
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaVarMul
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
ord714
__vbaFPException
__vbaStrVarVal
__vbaVarCat
ord644
_CIlog
__vbaErrorOverflow
__vbaNew2
__vbaVar2Vec
__vbaCyMulI2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaForEachAry
__vbaVarCmpEq
__vbaAryLock
__vbaVarAdd
__vbaVarDup
__vbaAryVarVarg
__vbaVarCopy
_CIatan
__vbaStrMove
__vbaAryCopy
__vbaI4Cy
__vbaStrVarCopy
__vbaForEachVar
_allmul
ord652
_CItan
__vbaAryUnlock
_CIexp
__vbaStrCy
__vbaFreeStr
__vbaFreeObj

Sections

.text
Size: 116KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

Errors

General

Malware Config

Signatures

Files

1cec45f658d4bfa06def0b907f64cfc8

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 116KB - Virtual size: 114KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 20KB - Virtual size: 17KB

.text
Size: 116KB - Virtual size: 114KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 20KB - Virtual size: 17KB