General

  • Target

    3f66bd7050539f98a0373aec978cfc73

  • Size

    15.7MB

  • MD5

    3f66bd7050539f98a0373aec978cfc73

  • SHA1

    ecc1a246b42303a22e535ab829e1311500ebbc14

  • SHA256

    e0f492b56cdde36c64daa34406e43e16113e7b7e43952895529dea6b65eacd6b

  • SHA512

    e5bc6ecad9feed52a13393c31e3953982d2bfe2eb68a3c51ff8b5b05aac0391e40ffb2fdb850fe7e225e01b357e42182d79ca0bc62a18495eac48b0ac5ef9ebb

  • SSDEEP

    393216:uktNbtNH3Gs5j887Hhv5epWgmgEtJ+HpaAekDaWHXT:ukDbtNH35jt750lmwHptZDaWHj

Malware Config

Signatures

  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

Files

  • 3f66bd7050539f98a0373aec978cfc73
    .rar
  • BuhtaClient.etl
    .vbs
  • BuhtaClient.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • BuhtaDev.chm
    .chm
  • BuhtaDev.lst
  • BuhtaPivot.xla
    .xls .xla windows office2003

    ЭтаКнига

    Лист1

    frmBasesList

    Module1

  • BuhtaServer.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Buhta_Show_FieldName_MSWordForm.frm
  • Buhta_Show_FieldName_MSWordForm.frx
  • Buhta_Show_FieldNames_List_Form.frm
  • Buhta_Show_FieldNames_List_Form.frx
  • ExpressSpreadSheet.HLP
  • ExpressSpreadSheet.cnt
  • Fruser.cnt
  • Fruser.hlp
  • PivotInstall.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • dsd.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • eapi.dll
    .dll windows:4 windows x86 arch:x86

    603880d61e6dd7c491f461f080fa4a37


    Headers

    Imports

    Exports

    Sections

  • quricol32.dll
    .dll windows:5 windows x86 arch:x86

    f44ea95867dfd4a725b69e9377af75fe


    Headers

    Imports

    Exports

    Sections