Static task
static1
Behavioral task
behavioral1
Sample
cdbb23d2903063282fe152ac63e2838af4c099c2fa18e91d44448ede4cef0a30.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
cdbb23d2903063282fe152ac63e2838af4c099c2fa18e91d44448ede4cef0a30.exe
Resource
win10v2004-20230220-en
General
-
Target
53b33f55cb362ea03a85def0a7eda81e.bin
-
Size
231KB
-
MD5
e6a9b7d0b3224a3aeff3c7d24d805963
-
SHA1
c9a0a29adcf201ebdbf503f59eb9e887dd579458
-
SHA256
eae553a6208a9249b81475498a68138ab278ffd3c1c833306a55f43474b8fe7e
-
SHA512
879900c871b5d0c63643fd4b920f510e4527ace8a1f04c2d2c37e7a377618ad30d1a25457c068bd9c2a0fd9135ba608286f417dea4051f5596419e9a803637f9
-
SSDEEP
6144:B4cFlD05kOcsdUFJ28N4uf7texLwzTmeVAG5Xyo0j198HC4G:ucFlw9dUFwube6jaOoj1p
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cdbb23d2903063282fe152ac63e2838af4c099c2fa18e91d44448ede4cef0a30.exe
Files
-
53b33f55cb362ea03a85def0a7eda81e.bin.zip
Password: infected
-
cdbb23d2903063282fe152ac63e2838af4c099c2fa18e91d44448ede4cef0a30.exe.exe windows x86
Password: infected
ea06f0ebd05782e9caa4e3157d406e08
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
_adj_fptan
__vbaStrI4
__vbaAryMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
ord698
__vbaFreeObjList
ord516
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
ord666
__vbaAryVar
__vbaVarTstLe
ord667
__vbaAryDestruct
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
ord631
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaGet3
__vbaStrCmp
__vbaAryConstruct2
__vbaI2I4
DllFunctionCall
_adj_fpatan
EVENT_SINK_Release
__vbaUI1I2
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord607
ord608
__vbaFPException
ord717
__vbaStrVarVal
__vbaUbound
__vbaVarCat
ord537
ord644
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
__vbaVar2Vec
__vbaInStr
__vbaCyMulI2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarCmpEq
__vbaAryLock
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
__vbaVarCopy
ord617
_CIatan
__vbaUI1Str
__vbaAryCopy
ord618
__vbaStrMove
__vbaI4Cy
__vbaStrVarCopy
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
Sections
.text Size: 108KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ