kutaki | a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27

General

Target
a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27
Size 743KB
Sample240204-ws9nrafgh9
SHA256 a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27
MD5 3636153d8fdc065fc40aae264f39eb7f
SHA1 3f62736088952839a2379bb33575fc1e963e784e
SHA512 96337dc43b446f6a2793715a8716a4ee688f9e0587020554dcc9a65c21a0b3ea54a2cf29954e23485b0fc29897a84d73a8df560d8b3dfc6f1807b7ca2da8a2b8
SSDEEP 12288:pUTq7ZKSOkkd+kQpGPqlSpwhm4s5bsGSCs5:u0ZIkkd+LrlSpnHuGE5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27

File Explorer

a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27

.exe 743KB

a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27

IMPHASH 96c066e41a4ce8400f2d986131b7bc00
SHA256 a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27
MD5 3636153d8fdc065fc40aae264f39eb7f
SHA1 3f62736088952839a2379bb33575fc1e963e784e
SHA512 96337dc43b446f6a2793715a8716a4ee688f9e0587020554dcc9a65c21a0b3ea54a2cf29954e23485b0fc29897a84d73a8df560d8b3dfc6f1807b7ca2da8a2b8
SSDEEP 12288:pUTq7ZKSOkkd+kQpGPqlSpwhm4s5bsGSCs5:u0ZIkkd+LrlSpnHuGE5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Kutaki Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14224

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaVarTstGt ord690 __vbaStrI2 _CIcos _adj_fptan __vbaHresultCheck __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLateIdCall __vbaStrVarMove __vbaLenBstr ord696 __vbaEnd __vbaPut3 __vbaFreeVarList _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord518 __vbaI2Abs __vbaVarCmpNe __vbaStrCat ord660 __vbaLsetFixstr __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock __vbaLateMemSt __vbaForEachCollObj __vbaBoolStr __vbaVarForInit __vbaStrBool __vbaExitProc ord300 __vbaStrLike __vbaObjSet ord595 __vbaOnError ord596 _adj_fdiv_m16i ord303 __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord599 ord306 __vbaStrFixstr ord520 __vbaBoolVar ord309 __vbaRefVarAry __vbaFpR8 __vbaBoolVarNull __vbaVarTstLt _CIsin __vbaErase ord709 __vbaNextEachCollObj __vbaVarCmpGt __vbaVargVarMove ord632 ord525 __vbaVarZero __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaExitEachColl ord529 __vbaGet3 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaR4Str __vbaPrintObj ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord563 __vbaVarOr ord670 __vbaVarLateMemSt ord564 __vbaCastObjVar __vbaLbound __vbaStrR4 _adj_fpatan __vbaR4Var __vbaFixstrConstruct __vbaLateIdCallLd __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaLateIdCallSt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 ord712 __vbaStrToUnicode __vbaPrintFile ord713 _adj_fprem _adj_fdivr_m64 __vbaI2Str ord607 ord714 ord608 ord716 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVar2Vec __vbaInStr ord570 ord648 __vbaR8Str __vbaVarLateMemCallLdRf __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarNot __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var ord689 __vbaVarCmpEq ord610 __vbaAryLock __vbaLateMemCall __vbaVarAdd ord612 __vbaStrToAnsi __vbaVarDup __vbaUnkVar __vbaFpI4 ord616 __vbaVarCopy __vbaVarLateMemCallLd ord617 __vbaLateMemCallLd _CIatan __vbaCastObj __vbaAryCopy __vbaStrMove __vbaForEachVar __vbaStrVarCopy ord619 _allmul __vbaVarLateMemCallSt __vbaLateIdSt _CItan ord546 __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Resubmissions

Sharing