kutaki | f6055f8771a3cedda61a3dc1ccbcec24[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

f6055f8771a3cedda61a3dc1ccbcec24.zip
Size

336KB
MD5

f6055f8771a3cedda61a3dc1ccbcec24
SHA1

bb82da45d019c38a322547f00fbf417c7301edf5
SHA256

86f2f67706a120d121c11a372895ab615bf2bfb0cba091a850e17ccd8d8855ad
SHA512

f4b2da67419b20d9de0dbb6fbd324510ded26d9009912ff709b28e2418a2ebde9ad980f659b749f8dd3622b5df2b1ccdb6908e30997f4878b0d08efd4457e93f
SSDEEP

6144:mqN2xpdMy58FAHHL1+4GpA9jQHL/VCSS3hwVlMbk2u5QMSIy+lqkHTonerW/lYRB:mjpdM48Cg48A9jQr/Uh8peMSI8EknPdK

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

http://linkwotowoto.club/new/two.php

Signatures

Kutaki Executable 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/Tax Payment Confirmation.exe	family_kutaki

Kutaki family
kutaki

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/Tax Payment Confirmation.exe

Files

f6055f8771a3cedda61a3dc1ccbcec24.zip
.zip
Tax Payment Confirmation.exe
.exe windows:4 windows x86

3910e25da1d2ff6583dec41939e4bd20

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarTstGt
__vbaVarSub
ord690
__vbaStrI2
_CIcos
_adj_fptan
__vbaHresultCheck
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
__vbaLenBstr
__vbaLateIdCall
__vbaStrVarMove
ord696
__vbaPut3
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
ord698
__vbaPut4
__vbaNextEachVar
__vbaFreeObjList
ord516
__vbaVarIndexLoadRef
__vbaStrErrVarCopy
_adj_fprem1
ord518
ord626
ord519
__vbaForEachCollAd
__vbaVarCmpNe
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
__vbaLenBstrB
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
ord666
__vbaAryVar
ord667
__vbaAryDestruct
ord591
__vbaVarIndexLoadRefLock
ord593
__vbaVarForInit
__vbaExitProc
ord594
__vbaI4Abs
ord595
__vbaOnError
__vbaObjSet
ord596
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
__vbaForEachCollVar
ord520
__vbaStrFixstr
__vbaBoolVarNull
__vbaRefVarAry
__vbaFpR8
_CIsin
ord631
__vbaErase
__vbaVarCmpGt
__vbaVargVarMove
ord525
ord632
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaGenerateBoundsError
__vbaGet3
ord529
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaGet4
__vbaPutOwner4
__vbaNextEachCollVar
ord561
__vbaObjVar
__vbaI2I4
DllFunctionCall
ord563
__vbaVarOr
ord670
ord564
__vbaLbound
_adj_fpatan
ord568
__vbaLateIdCallLd
__vbaR8Cy
__vbaStrR8
__vbaRedim
EVENT_SINK_Release
__vbaNew
ord600
ord601
__vbaUI1I2
_CIsqrt
__vbaObjIs
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaStr2Vec
__vbaUI1I4
__vbaStrUI1
__vbaExceptHandler
ord711
__vbaPrintFile
ord712
__vbaStrToUnicode
ord713
_adj_fprem
_adj_fdivr_m64
ord714
ord607
ord608
__vbaFPException
__vbaInStrVar
ord717
__vbaUbound
__vbaStrVarVal
ord534
__vbaGetOwner4
__vbaVarCat
__vbaI2Var
__vbaLsetFixstrFree
ord644
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord570
ord648
__vbaR8Str
__vbaVarLateMemCallLdRf
__vbaVar2Vec
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
ord573
__vbaStrCopy
ord681
__vbaI4Str
__vbaVarCmpLt
__vbaFreeStrList
ord576
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaI4Var
ord689
__vbaFpCy
__vbaVarAdd
__vbaAryLock
__vbaStrToAnsi
__vbaStrComp
__vbaVarDup
__vbaFpI2
__vbaVarLateMemCallLd
ord616
__vbaFpI4
__vbaLateMemCallLd
ord617
_CIatan
__vbaCastObj
__vbaAryCopy
ord618
__vbaStrMove
__vbaForEachVar
__vbaR8IntI4
__vbaStrVarCopy
ord619
_allmul
__vbaLateIdSt
_CItan
__vbaNextEachCollAd
__vbaUI1Var
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581

Sections

.text
Size: 228KB - Virtual size: 227KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 264KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

3910e25da1d2ff6583dec41939e4bd20

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 228KB - Virtual size: 227KB

.data Size: 4KB - Virtual size: 17KB

.rsrc Size: 264KB - Virtual size: 261KB

.text
Size: 228KB - Virtual size: 227KB

.data
Size: 4KB - Virtual size: 17KB

.rsrc
Size: 264KB - Virtual size: 261KB