2b453175bac76a8fc5b8c76fcaebfdd3

Sharing

Copy URL Twitter E-mail

General

Target

2b453175bac76a8fc5b8c76fcaebfdd3
Size

16KB
MD5

2b453175bac76a8fc5b8c76fcaebfdd3
SHA1

21563cfb6f1f16cdfad21743cd4c763cada30dd3
SHA256

89066791debd76a797f2839d53d85eb0ac62456f7eb73314f88ead7121bee95c
SHA512

73f45471359f0c5b720c5671f4670ac9c43f26e6f8282c28be58b446850847eb9a1dfec3fa91747cdd34574f29cc99f634468372cacf2fbc7880bd7494c9c007
SSDEEP

192:viQRd+vEMbdJkwK4KbzfqTgq1FRl65CAdGlYqufZnFptC0g2SbubzIka:6aaRkfqsOfTGfZHtWbjka

Score

1^/10

Malware Config

Signatures

Files

2b453175bac76a8fc5b8c76fcaebfdd3
.xll windows:1 windows x86 arch:x86

1dcdb5550f0e3d7e686b361f67a1f2d8

Code Sign

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/01/2004, 00:00

Not After

31/12/2028, 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

67:0c:34:94:20:6b:9f:0c:18:71:4f:dc:ff:aa:a4:2f
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/05/2021, 00:00

Not After

28/05/2022, 23:59

Subject

CN=ADRIATIK PORT SERVIS\, d.o.o.,O=ADRIATIK PORT SERVIS\, d.o.o.,L=Koper,C=SI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

41:7f:9e:c0:2f:11:d6:70:b4:6b:68:6e:f5:cc:4d:ea:87:ca:64:97
Signer

Actual PE Digest

41:7f:9e:c0:2f:11:d6:70:b4:6b:68:6e:f5:cc:4d:ea:87:ca:64:97

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

__vbaAryMove
PutMemNewObj
__vbaStrVarVal
rtcChangeDrive
__vbaVarTstGe
rtcLog
__vbaGetFxStr4
__vbaVargVarRef
__vbaVarCat
__vbaRecDestructAnsi
__vbaStrVarMove
__vbaVarSetObjAddref
__vbaVarTextCmpLt
__vbaVarIndexLoadRefLock
rtcGetTimeVar
__vbaDateR8
__vbaRefVarAry
__vbaWriteFile
__vbaPut4
__vbaAryRecMove
rtcMidCharBstr
__vbaLateIdCallLd
__vbaLbound
__vbaVarMove
__vbaLenBstr
_CIlog
__vbaCyI4
__vbaVarTstGt
__vbaForEachVar
rtcArray
EbLibraryUnload
rtcDDB
__vbaVarCopy
_adj_fptan
rtI2FromErrVar
__vbaVarIndexLoad
GetMemStr
GetMemEvent

oleaut32

VarUI8FromI8
VarMod
VarBoolFromR4
VarBoolFromI8
GetErrorInfo
VarBstrFromR4
SafeArrayLock
VarUI2FromUI1

ole32

SetConvertStg
CoTestCancel
HENHMETAFILE_UserMarshal
HBITMAP_UserUnmarshal
GetHookInterface
HBRUSH_UserUnmarshal
HENHMETAFILE_UserFree
HPALETTE_UserFree
GetHGlobalFromStream
HENHMETAFILE_UserUnmarshal
OleDestroyMenuDescriptor
OleCreateStaticFromData

Exports

Exports

xlAutoOpen

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ico
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.img
Size: - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.txt
Size: - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.res
Size: - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 66B

IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1dcdb5550f0e3d7e686b361f67a1f2d8

Code Sign

01Certificate

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

67:0c:34:94:20:6b:9f:0c:18:71:4f:dc:ff:aa:a4:2fCertificate

Extended Key Usages

Key Usages

41:7f:9e:c0:2f:11:d6:70:b4:6b:68:6e:f5:cc:4d:ea:87:ca:64:97Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvbvm60

oleaut32

ole32

Exports

Exports

Sections

.data Size: 4KB - Virtual size: 4KB

.ico Size: 4KB - Virtual size: 4KB

.img Size: - Virtual size: 512B

.txt Size: - Virtual size: 512B

.data Size: - Virtual size: 512B

.res Size: - Virtual size: 512B

.text Size: - Virtual size: 512B

.edata Size: 512B - Virtual size: 66B

.reloc Size: 512B - Virtual size: 8B

01
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

67:0c:34:94:20:6b:9f:0c:18:71:4f:dc:ff:aa:a4:2f
Certificate

41:7f:9e:c0:2f:11:d6:70:b4:6b:68:6e:f5:cc:4d:ea:87:ca:64:97
Signer

.data
Size: 4KB - Virtual size: 4KB

.ico
Size: 4KB - Virtual size: 4KB

.img
Size: - Virtual size: 512B

.txt
Size: - Virtual size: 512B

.data
Size: - Virtual size: 512B

.res
Size: - Virtual size: 512B

.text
Size: - Virtual size: 512B

.edata
Size: 512B - Virtual size: 66B

.reloc
Size: 512B - Virtual size: 8B