pingbao[.]scr | Triage™

Reason

config extraction: GuloaderBin: guloader: invalid shellcode

General

Target
pingbao.scr
Size 18.8MB
Sample230206-e2vgrafd9s
SHA256 9624b8343c38e8000f4140dc91527dcfc7700f66e4938544c75cd95faa626d47
MD5 a07e847b264e8c9345d10bb0a8cfe16b
SHA1 3fb2b823ffbfde19e54dee5a397c82cf397f7b4b
SHA512 bcb33edc18f44173c6d4ca8ef8045a149a5f218add8a6a02a294fbcb27b67580e3df165d198fd2fe0cef7468f7ef45b7a15ab6f1f1c3f54f3a38a14ca219503e
SSDEEP 393216:eMcG6kTk2kZskClpXcrbcv0skhMY5bEdwYFBE837z5zEemeOmcBtjW9ZTMINN/o:C8kLCPcrov0ZmKbEdw+Es79zmtmcTKZI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

pingbao.scr

.exe 18.8MB

pingbao.scr

IMPHASH a2689a0221350d4824808a49a64185f6
SHA256 9624b8343c38e8000f4140dc91527dcfc7700f66e4938544c75cd95faa626d47
MD5 a07e847b264e8c9345d10bb0a8cfe16b
SHA1 3fb2b823ffbfde19e54dee5a397c82cf397f7b4b
SHA512 bcb33edc18f44173c6d4ca8ef8045a149a5f218add8a6a02a294fbcb27b67580e3df165d198fd2fe0cef7468f7ef45b7a15ab6f1f1c3f54f3a38a14ca219503e
SSDEEP 393216:eMcG6kTk2kZskClpXcrbcv0skhMY5bEdwYFBE837z5zEemeOmcBtjW9ZTMINN/o:C8kLCPcrov0ZmKbEdw+Es79zmtmcTKZI
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

29840

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaVargParmRef _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaAryMove __vbaFreeVar ord588 __vbaLineInputStr __vbaLenBstr __vbaStrVarMove __vbaFreeVarList __vbaEnd _adj_fdiv_m64 __vbaVarIndexStore __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord518 __vbaCopyBytes __vbaResume __vbaStrCat __vbaLsetFixstr __vbaRecDestruct __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaVarTstLe __vbaAryDestruct ord669 ord591 __vbaLateMemSt __vbaForEachCollObj __vbaExitProc ord593 ord594 ord595 __vbaOnError __vbaObjSet ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaVarIndexLoad __vbaBoolVar __vbaFPFix __vbaRefVarAry __vbaBoolVarNull _CIsin ord524 ord631 __vbaErase ord525 __vbaNextEachCollObj __vbaVarZero __vbaVarCmpGt __vbaChkstk __vbaFileClose EVENT_SINK_AddRef ord527 ord528 __vbaVarAbs __vbaGet3 ord529 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaR4Str __vbaObjVar ord561 DllFunctionCall ord563 ord670 __vbaVarLateMemSt __vbaVarOr __vbaLbound __vbaRedimPreserve _adj_fpatan __vbaR4Var __vbaFixstrConstruct __vbaLateIdCallLd __vbaStrR8 __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 _CIsqrt __vbaRedimVar __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaVarMul __vbaExceptHandler ord711 ord712 __vbaStrToUnicode ord606 _adj_fprem _adj_fdivr_m64 __vbaFailedFriend __vbaVarDiv ord607 __vbaLateIdStAd ord608 ord531 __vbaFPException __vbaInStrVar ord717 __vbaGetOwner3 __vbaUbound __vbaStrVarVal __vbaR4ForNextCheck __vbaVarCat __vbaLsetFixstrFree __vbaFileSeek ord537 ord644 ord645 _CIlog __vbaFileOpen ord570 __vbaR8Str __vbaVar2Vec ord648 __vbaInStr __vbaNew2 ord571 _adj_fdiv_m32i ord572 _adj_fdivr_m32i __vbaStrCopy __vbaI4Str __vbaFreeStrList _adj_fdivr_m32 ord577 __vbaPowerR8 _adj_fdiv_r ord685 ord578 ord100 __vbaVarTstNe ord579 __vbaI4Var __vbaVarLateMemStAd __vbaVarCmpEq __vbaLateMemCall __vbaVarAdd __vbaAryLock __vbaVarDup __vbaStrToAnsi __vbaVerifyVarObj __vbaFpI2 __vbaVarCopy __vbaVarLateMemCallLd __vbaFpI4 ord616 ord617 __vbaRecDestructAnsi __vbaLateMemCallLd __vbaR8IntI2 _CIatan __vbaUI1Str __vbaAryCopy __vbaStrMove __vbaCastObj ord618 __vbaStrVarCopy ord619 __vbaR8IntI4 ord650 _allmul __vbaLenVarB _CItan ord546 __vbaAryUnlock __vbaFPInt _CIexp __vbaFreeStr __vbaFreeObj __vbaI4ErrVar ord581

Resubmissions

Sharing

Errors