A9B8F25D1EF79152C2BBD49418ADD108[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

A9B8F25D1EF79152C2BBD49418ADD108.exe
Size

6.0MB
MD5

a9b8f25d1ef79152c2bbd49418add108
SHA1

d36b7214b6c9f2861c6cff35e58bbbcae0cac089
SHA256

d4b7dbdfda9407b750446a58d7df87c2aa5f8e03382b9b9d14799f8dbdb58a32
SHA512

d2b415210af9a8ed8b04f4382447d27ca137fc70a0f84c8a7d32212568fc8a4b324aef733441c1a00d7d81ed921384020ead383bdf3849614de9eb2a23696570
SSDEEP

98304:jnmLPRpJNZyi1pr5qRwHuSX/qM9CWnp+HKE1c4/200nZDKaTLb4SQez7Xf:j2HJDyi1pYSXCMkWnsKir/20KDBTQ8j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
A9B8F25D1EF79152C2BBD49418ADD108.exe

Files

A9B8F25D1EF79152C2BBD49418ADD108.exe
.exe windows x86

1639b36478084cb644ebc8b99bead606

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarTstGt
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaLenBstr
__vbaLateIdCall
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
ord516
__vbaVarIndexLoadRef
_adj_fprem1
ord518
ord519
__vbaStrCat
__vbaLsetFixstr
ord660
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaLateMemSt
ord592
__vbaVarPow
__vbaVarForInit
__vbaExitProc
ord300
ord301
ord595
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord304
__vbaVarIndexLoad
ord598
ord306
__vbaBoolVar
ord520
ord307
__vbaStrTextCmp
__vbaFpR8
__vbaBoolVarNull
_CIsin
ord524
__vbaErase
ord525
__vbaVarZero
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord529
__vbaStrCmp
__vbaVarTstEq
__vbaAryConstruct2
ord560
__vbaObjVar
__vbaPrintObj
__vbaI2I4
DllFunctionCall
__vbaCastObjVar
__vbaLbound
__vbaRedimPreserve
_adj_fpatan
__vbaR4Var
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaRedim
EVENT_SINK_Release
__vbaNew
ord600
ord601
__vbaUI1I2
_CIsqrt
ord310
__vbaVarAnd
__vbaLateIdCallSt
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaUI1I4
__vbaExceptHandler
ord312
__vbaInputFile
__vbaPrintFile
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
__vbaVarDiv
__vbaLateIdStAd
__vbaI2Str
__vbaFPException
__vbaStrCompVar
ord717
__vbaStrVarVal
__vbaUbound
__vbaVarCat
ord534
__vbaCheckType
__vbaDateVar
__vbaLsetFixstrFree
__vbaI2Var
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaInStr
ord648
__vbaR8Str
__vbaNew2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
ord573
__vbaStrCopy
ord681
__vbaVarNot
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaI4Var
__vbaVarCmpEq
__vbaLateMemCall
__vbaVarAdd
__vbaAryLock
__vbaStrComp
ord612
__vbaVarDup
__vbaStrToAnsi
ord613
__vbaVerifyVarObj
__vbaVarMod
__vbaVarCopy
__vbaFpI4
__vbaLateMemCallLd
ord617
_CIatan
__vbaUI1Str
__vbaCastObj
__vbaStrMove
ord619
__vbaStrVarCopy
ord650
_allmul
__vbaLateIdSt
_CItan
ord546
__vbaUI1Var
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaI4ErrVar
__vbaFreeStr
__vbaFreeObj
ord581

kernel32

GetSystemTimeAsFileTime
CreateEventA
GetModuleFileNameW
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetModuleHandleW
LoadResource
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
DecodePointer
GetCommandLineA
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
RaiseException
LCMapStringW
GetStringTypeW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 379KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.@({
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.r`4
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.7\o
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1639b36478084cb644ebc8b99bead606

Headers

File Characteristics

Imports

msvbvm60

kernel32

user32

Sections

.text Size: - Virtual size: 379KB

.data Size: - Virtual size: 49KB

.@({ Size: - Virtual size: 3.2MB

.r`4 Size: 4KB - Virtual size: 1KB

.7\o Size: 6.0MB - Virtual size: 6.0MB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: - Virtual size: 379KB

.data
Size: - Virtual size: 49KB

.@({
Size: - Virtual size: 3.2MB

.r`4
Size: 4KB - Virtual size: 1KB

.7\o
Size: 6.0MB - Virtual size: 6.0MB

.rsrc
Size: 4KB - Virtual size: 1KB