38fbddeef497c50f580f95103ffb489f

Sharing

Copy URL Twitter E-mail

General

Target

38fbddeef497c50f580f95103ffb489f
Size

15KB
MD5

38fbddeef497c50f580f95103ffb489f
SHA1

92a38725a32383fb09bd7dd6c88f4d6978b3e9b1
SHA256

e5f118207a57529e43ea8c20b88dce5063274124902491c24e07bb918d8e02c3
SHA512

1e6186706f49a423bf091f1f67c4450bac07bce9788f6aae17ca243ecec1f92aebec22d52b83b65a8f07be9c9d9740e53168f1c2c25ea9ea99e7e82efb4eb844
SSDEEP

192:sc3j+vEMbdJkwKRhRu4UpC7c39iFRl6nCAdGlYqufZnFptC0g2Sr5RAO:s2a+RLcmxTGfZHtWr53

Score

1^/10

Malware Config

Signatures

Files

38fbddeef497c50f580f95103ffb489f
.xll windows:1 windows x86 arch:x86

1dcdb5550f0e3d7e686b361f67a1f2d8

Code Sign

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/01/2004, 00:00

Not After

31/12/2028, 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

67:0c:34:94:20:6b:9f:0c:18:71:4f:dc:ff:aa:a4:2f
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/05/2021, 00:00

Not After

28/05/2022, 23:59

Subject

CN=ADRIATIK PORT SERVIS\, d.o.o.,O=ADRIATIK PORT SERVIS\, d.o.o.,L=Koper,C=SI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

29:a3:48:cc:78:f0:a8:64:b2:b2:b5:36:aa:bf:77:96:aa:3f:f9:b4
Signer

Actual PE Digest

29:a3:48:cc:78:f0:a8:64:b2:b2:b5:36:aa:bf:77:96:aa:3f:f9:b4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

__vbaAryMove
PutMemNewObj
__vbaStrVarVal
rtcChangeDrive
__vbaVarTstGe
rtcLog
__vbaGetFxStr4
__vbaVargVarRef
__vbaVarCat
__vbaRecDestructAnsi
__vbaStrVarMove
__vbaVarSetObjAddref
__vbaVarTextCmpLt
__vbaVarIndexLoadRefLock
rtcGetTimeVar
__vbaDateR8
__vbaRefVarAry
__vbaWriteFile
__vbaPut4
__vbaAryRecMove
rtcMidCharBstr
__vbaLateIdCallLd
__vbaLbound
__vbaVarMove
__vbaLenBstr
_CIlog
__vbaCyI4
__vbaVarTstGt
__vbaForEachVar
rtcArray
EbLibraryUnload
rtcDDB
__vbaVarCopy
_adj_fptan
rtI2FromErrVar
__vbaVarIndexLoad
GetMemStr
GetMemEvent

oleaut32

VarUI8FromI8
VarMod
VarBoolFromR4
VarBoolFromI8
GetErrorInfo
VarBstrFromR4
SafeArrayLock
VarUI2FromUI1

ole32

SetConvertStg
CoTestCancel
HENHMETAFILE_UserMarshal
HBITMAP_UserUnmarshal
GetHookInterface
HBRUSH_UserUnmarshal
HENHMETAFILE_UserFree
HPALETTE_UserFree
GetHGlobalFromStream
HENHMETAFILE_UserUnmarshal
OleDestroyMenuDescriptor
OleCreateStaticFromData

Exports

Exports

xlAutoOpen

Sections

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ico
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.img
Size: - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.txt
Size: - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.res
Size: - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 66B

IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1dcdb5550f0e3d7e686b361f67a1f2d8

Code Sign

01Certificate

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

67:0c:34:94:20:6b:9f:0c:18:71:4f:dc:ff:aa:a4:2fCertificate

Extended Key Usages

Key Usages

29:a3:48:cc:78:f0:a8:64:b2:b2:b5:36:aa:bf:77:96:aa:3f:f9:b4Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvbvm60

oleaut32

ole32

Exports

Exports

Sections

.data Size: 3KB - Virtual size: 3KB

.ico Size: 4KB - Virtual size: 4KB

.img Size: - Virtual size: 512B

.txt Size: - Virtual size: 512B

.data Size: - Virtual size: 512B

.res Size: - Virtual size: 512B

.text Size: - Virtual size: 512B

.edata Size: 512B - Virtual size: 66B

.reloc Size: 512B - Virtual size: 8B

01
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

67:0c:34:94:20:6b:9f:0c:18:71:4f:dc:ff:aa:a4:2f
Certificate

29:a3:48:cc:78:f0:a8:64:b2:b2:b5:36:aa:bf:77:96:aa:3f:f9:b4
Signer

.data
Size: 3KB - Virtual size: 3KB

.ico
Size: 4KB - Virtual size: 4KB

.img
Size: - Virtual size: 512B

.txt
Size: - Virtual size: 512B

.data
Size: - Virtual size: 512B

.res
Size: - Virtual size: 512B

.text
Size: - Virtual size: 512B

.edata
Size: 512B - Virtual size: 66B

.reloc
Size: 512B - Virtual size: 8B