5a8d78a87126eb2203ef322c64c697aea772af2d230b3e9ac0a7ea24a8348509[.]zip

Sharing

Copy URL Twitter E-mail

Reason

config extraction: GuloaderBin: guloader: invalid shellcode

General

Target

5a8d78a87126eb2203ef322c64c697aea772af2d230b3e9ac0a7ea24a8348509.zip
Size

6.1MB
MD5

55e76c4ee9306d45cf6c8fd0384c41ea
SHA1

a6e7501e78343625946962b6ff2fd104443a914d
SHA256

b24b28294603d59d7024eefcc71b71175ce9a727025cbb17c00f96615f486f8f
SHA512

69b7288a2dc687ac30fb4f6cd20a5ed0d200ce608eeab7dfefe2303c525f9427dd365403efb18094f9d097e1608816e0851a44716a7332e09d18c884772596f3
SSDEEP

98304:RpM+xUvlEAlEadHQglW3zH2kazVM9/yV5jToSaPuVUb/8/pjGiToPfkQOn:/ovIa5QglW3zH2s6DToSaDb/cpjtTeY

Score

1^/10

Malware Config

Signatures

Files

5a8d78a87126eb2203ef322c64c697aea772af2d230b3e9ac0a7ea24a8348509.zip
.zip

Password: infected
5a8d78a87126eb2203ef322c64c697aea772af2d230b3e9ac0a7ea24a8348509
.zip
FinComp.exe
.exe windows:4 windows x86

00aee956b3b345a222feb80f01c5c9ac

Code Sign

18:aa:c3:df:20:c9:62:54:fb:23:97:1c:ce:e4:79:ea
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

26/06/2018, 00:00

Not After

26/06/2019, 23:59

Subject

CN=Plansmith Corporation,O=Plansmith Corporation,POSTALCODE=60173,STREET=1827 Walden office sq\, suite 350,L=Schaumburg,ST=Illinois,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7c:72:7d:b6:e4:56:5b:77:e8:0d:5e:d1:e2:d1:7e:1d:a9:0f:2c:02:83:7b:89:1a:a8:c7:9e:10:ac:3a:fa:95
Signer

Actual PE Digest

7c:72:7d:b6:e4:56:5b:77:e8:0d:5e:d1:e2:d1:7e:1d:a9:0f:2c:02:83:7b:89:1a:a8:c7:9e:10:ac:3a:fa:95

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
__vbaVarTstGt
__vbaStrI2
_CIcos
_adj_fptan
__vbaHresultCheck
__vbaVarMove
__vbaStrI4
ord586
__vbaVarVargNofree
ord587
__vbaFpCDblR4
__vbaAryMove
__vbaFreeVar
ord588
__vbaLineInputStr
__vbaLateIdCall
__vbaLenBstr
__vbaGosubReturn
__vbaStrVarMove
ord589
__vbaPut3
__vbaVarIdiv
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFpCDblR8
__vbaAryRecMove
ord621
__vbaFreeObjList
__vbaR8Sgn
ord516
__vbaVarIndexLoadRef
__vbaVarFix
__vbaStrErrVarCopy
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord626
ord519
__vbaI2Abs
__vbaCopyBytes
__vbaVarCmpNe
__vbaStrCat
__vbaCyInt
__vbaBoolErrVar
ord660
ord553
__vbaLsetFixstr
__vbaRecDestruct
ord661
__vbaStrDate
__vbaSetSystemError
ord662
__vbaHresultCheckObj
ord557
__vbaVargVarCopy
ord558
__vbaLenVar
_adj_fdiv_m32
__vbaVarTstLe
__vbaAryVar
__vbaVarCmpGe
__vbaAryDestruct
__vbaVarIndexLoadRefLock
ord669
__vbaLateMemSt
ord592
ord593
__vbaVarForInit
__vbaForEachCollObj
__vbaStrBool
__vbaBoolStr
__vbaExitProc
ord300
ord594
__vbaI4Abs
__vbaFileCloseAll
ord301
ord595
__vbaObjSet
__vbaOnError
ord302
ord596
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
ord305
ord599
__vbaFpR4
ord306
ord520
__vbaStrFixstr
__vbaBoolVar
ord307
ord521
ord308
ord707
__vbaFPFix
ord309
__vbaVargVar
__vbaRefVarAry
__vbaVarTstLt
__vbaBoolVarNull
__vbaFpR8
ord523
_CIsin
ord524
__vbaErase
ord709
ord631
ord525
__vbaNextEachCollObj
__vbaVarZero
__vbaVarCmpGt
ord632
__vbaVargVarMove
__vbaChkstk
__vbaCyVar
ord526
__vbaFileClose
__vbaGosubFree
EVENT_SINK_AddRef
ord527
__vbaVarAbs
ord528
__vbaGenerateBoundsError
__vbaExitEachColl
__vbaCyI2
__vbaGet3
ord529
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaCyI4
__vbaR4Str
__vbaDateR8
ord560
__vbaPrintObj
ord561
__vbaI2I4
__vbaObjVar
DllFunctionCall
ord563
__vbaVarOr
__vbaVarLateMemSt
__vbaFpUI1
ord564
__vbaCySub
__vbaCastObjVar
__vbaStrR4
__vbaLbound
__vbaRedimPreserve
_adj_fpatan
__vbaR4Var
__vbaFixstrConstruct
__vbaR4Cy
__vbaLateIdCallLd
__vbaR8Cy
__vbaStrR8
__vbaRedim
__vbaRecUniToAnsi
__vbaDerefAry
EVENT_SINK_Release
__vbaNew
ord600
ord601
__vbaUI1I2
_CIsqrt
__vbaLateIdCallSt
__vbaObjIs
__vbaVarAnd
ord311
EVENT_SINK_QueryInterface
__vbaStrUI1
ord710
__vbaVarMul
__vbaStr2Vec
__vbaExceptHandler
ord711
ord313
__vbaInputFile
__vbaPrintFile
ord712
__vbaStrToUnicode
__vbaR4ErrVar
__vbaDateStr
ord606
_adj_fprem
_adj_fdivr_m64
__vbaLateIdStAd
ord607
ord714
__vbaR8ErrVar
__vbaGosub
__vbaVarDiv
__vbaI2Str
ord530
ord608
ord531
ord609
ord716
__vbaVarCmpLe
__vbaFPException
ord717
ord532
__vbaInStrVar
__vbaUbound
ord533
__vbaStrVarVal
__vbaR4ForNextCheck
__vbaVarCat
__vbaCheckType
ord535
__vbaDateVar
ord536
__vbaLsetFixstrFree
__vbaI2Var
ord644
ord537
ord645
ord538
_CIlog
__vbaErrorOverflow
ord647
__vbaFileOpen
__vbaVarLateMemCallLdRf
__vbaR8Str
ord570
__vbaVar2Vec
ord648
__vbaInStr
__vbaNew2
__vbaCyMulI2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
ord573
__vbaStrCopy
__vbaI4Str
ord681
__vbaVarCmpLt
__vbaVarNot
__vbaFreeStrList
ord576
__vbaDerefAry1
_adj_fdivr_m32
__vbaPowerR8
__vbaR8Var
_adj_fdiv_r
ord578
ord685
ord100
__vbaVarTstNe
__vbaI4Var
__vbaVarCmpEq
__vbaFpCy
__vbaVarAdd
__vbaAryLock
__vbaLateMemCall
ord612
__vbaVarDup
__vbaStrToAnsi
ord613
__vbaR4Sgn
ord614
__vbaFpI2
__vbaVarMod
__vbaVarTstGe
__vbaVarCopy
__vbaVarLateMemCallLd
ord616
__vbaFpI4
__vbaVarSetObjAddref
__vbaRecDestructAnsi
__vbaR8IntI2
ord617
__vbaLateMemCallLd
_CIatan
__vbaAryCopy
__vbaI2ErrVar
ord618
__vbaCastObj
__vbaStrMove
__vbaR8IntI4
ord619
__vbaStrVarCopy
ord542
ord543
ord650
_allmul
ord651
__vbaFpCSngR4
ord544
__vbaVarLateMemCallSt
__vbaLateIdSt
__vbaAryRecCopy
__vbaLateMemCallSt
ord545
_CItan
ord546
__vbaUI1Var
__vbaFPInt
__vbaAryUnlock
__vbaFpCSngR8
__vbaVarForNext
_CIexp
__vbaMidStmtBstr
__vbaR8FixI2
__vbaRecAssign
__vbaI4ErrVar
__vbaFreeObj
__vbaFreeStr
ord581

Sections

.text
Size: 51.3MB - Virtual size: 51.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

Errors

General

Malware Config

Signatures

Files

Password: infected

00aee956b3b345a222feb80f01c5c9ac

Code Sign

18:aa:c3:df:20:c9:62:54:fb:23:97:1c:ce:e4:79:eaCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

7c:72:7d:b6:e4:56:5b:77:e8:0d:5e:d1:e2:d1:7e:1d:a9:0f:2c:02:83:7b:89:1a:a8:c7:9e:10:ac:3a:fa:95Signer

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 51.3MB - Virtual size: 51.3MB

.data Size: 4KB - Virtual size: 262KB

.rsrc Size: 4KB - Virtual size: 3KB

18:aa:c3:df:20:c9:62:54:fb:23:97:1c:ce:e4:79:ea
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

7c:72:7d:b6:e4:56:5b:77:e8:0d:5e:d1:e2:d1:7e:1d:a9:0f:2c:02:83:7b:89:1a:a8:c7:9e:10:ac:3a:fa:95
Signer

.text
Size: 51.3MB - Virtual size: 51.3MB

.data
Size: 4KB - Virtual size: 262KB

.rsrc
Size: 4KB - Virtual size: 3KB