1c5d71b2ff1f67c3c6034224f63bfcaf[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

1c5d71b2ff1f67c3c6034224f63bfcaf.bin
Size

1.2MB
MD5

62d809b60d5130d9c46c4003af87b99b
SHA1

e70ac427defbce1eeb03dab7a5c61313a73a360e
SHA256

6d10c6464fb2a3b3eab48e71792aea5bd343fa6ee8785c8e2c99e610ac42e38d
SHA512

9181c9878abe5e1dd40e5aa825ca46115e1a6f4d90e6f7b2d5ec2f67783dbcbe398819637ce5df5a108712f6897da79981c23961a8fa118921b33c0f2327921d
SSDEEP

24576:y7RyIBkVV5rjaRaFagjIr3NFmDfWwvCUS+++uWR1tePYq6A35UwY4C:ccukVHrjaIFA3f6dvLpuntrUVx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/19418bf35ea127603058cc2c8862ba6805d363c20920785041bb420f6b7f2879.exe

Files

1c5d71b2ff1f67c3c6034224f63bfcaf.bin
.zip

Password: infected
19418bf35ea127603058cc2c8862ba6805d363c20920785041bb420f6b7f2879.exe
.exe windows x86

Password: infected

37131fbff34e2558bad26b7f739efcb7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
__vbaVarTstGt
__vbaStrI2
_CIcos
_adj_fptan
ord585
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaFpCDblR4
ord587
__vbaAryMove
__vbaFreeVar
__vbaCyMul
__vbaLenBstr
__vbaStrVarMove
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFpCDblR8
ord620
ord621
__vbaFreeObjList
ord517
__vbaStrErrVarCopy
_adj_fprem1
ord518
__vbaResume
__vbaStrCat
__vbaVarCmpNe
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaVarTstLe
__vbaAryDestruct
__vbaCyErrVar
__vbaVarForInit
__vbaBoolStr
__vbaStrBool
__vbaVarPow
__vbaExitProc
ord300
__vbaCyAdd
__vbaObjSet
ord595
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaCyStr
ord306
__vbaFpR8
__vbaBoolVarNull
__vbaVarTstLt
_CIsin
ord631
__vbaVargVarMove
__vbaChkstk
__vbaCyVar
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord529
__vbaCyI2
__vbaStrCmp
__vbaVarTstEq
__vbaR4Str
__vbaCyI4
__vbaI2I4
DllFunctionCall
__vbaCySub
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaR8Cy
__vbaStrR8
EVENT_SINK_Release
__vbaNew
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
__vbaStrToUnicode
__vbaPrintFile
_adj_fprem
_adj_fdivr_m64
ord607
__vbaVarDiv
ord714
ord608
__vbaFPException
__vbaInStrVar
__vbaUbound
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord537
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaInStr
__vbaVar2Vec
ord570
__vbaNew2
__vbaR8Str
ord648
__vbaCyMulI2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
__vbaR8Var
__vbaPowerR8
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaI4Var
__vbaVarCmpEq
__vbaFpCy
ord610
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
ord614
__vbaFpI4
ord616
__vbaVarCopy
__vbaVarTstGe
_CIatan
__vbaStrMove
__vbaCastObj
__vbaStrVarCopy
__vbaVarNeg
_allmul
__vbaLateIdSt
_CItan
__vbaVarForNext
_CIexp
__vbaStrCy
__vbaFreeStr
__vbaFreeObj

Sections

.text
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

37131fbff34e2558bad26b7f739efcb7

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 5.4MB - Virtual size: 5.4MB

.data Size: 4KB - Virtual size: 102KB

.rsrc Size: 3.5MB - Virtual size: 3.5MB

.text
Size: 5.4MB - Virtual size: 5.4MB

.data
Size: 4KB - Virtual size: 102KB

.rsrc
Size: 3.5MB - Virtual size: 3.5MB