8fa716e6d698cff761a257134fc0dcbc

General

Target
8fa716e6d698cff761a257134fc0dcbc
Size 244KB
Sample240205-cgfrragah3
SHA256 aa08fb940347c2e06c546e101a2628f13d1f26676b81f97a038296e620fd0e02
MD5 8fa716e6d698cff761a257134fc0dcbc
SHA1 1cbb32439e7024126f00f371ebddd81ec850110c
SHA512 524639d57e7c16d5a45d316fb540e6e0be8fdea137b53e9f2b58fa02883ed45175efb3d9d6ce722ecfc814656c9cf88418212c516e30e5c4077f5835935e4e63
SSDEEP 6144:dqz/fSW9BPwtfHImpvlhsvMRpSS8chIQQzsDU:ltf9U8vIQvDU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
sample	Nirsoft

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8fa716e6d698cff761a257134fc0dcbc

File Explorer

8fa716e6d698cff761a257134fc0dcbc

.exe 244KB

8fa716e6d698cff761a257134fc0dcbc

IMPHASH 1967a67b5605a832619cc4217a2952f7
SHA256 aa08fb940347c2e06c546e101a2628f13d1f26676b81f97a038296e620fd0e02
MD5 8fa716e6d698cff761a257134fc0dcbc
SHA1 1cbb32439e7024126f00f371ebddd81ec850110c
SHA512 524639d57e7c16d5a45d316fb540e6e0be8fdea137b53e9f2b58fa02883ed45175efb3d9d6ce722ecfc814656c9cf88418212c516e30e5c4077f5835935e4e63
SSDEEP 6144:dqz/fSW9BPwtfHImpvlhsvMRpSS8chIQQzsDU:ltf9U8vIQvDU
MD5 SHA1 SHA512 SSDEEP

Nirsoft
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7916

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaLateIdCall __vbaPut3 __vbaFreeVarList __vbaEnd _adj_fdiv_m64 ord620 __vbaFreeObjList ord516 _adj_fprem1 __vbaRecAnsiToUni __vbaStrCat __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryDestruct __vbaVarForInit __vbaFileCloseAll ord595 __vbaOnError __vbaObjSet ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord599 ord520 __vbaStrFixstr __vbaVarTstLt _CIsin ord632 __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef __vbaGet3 ord529 __vbaStrCmp __vbaPutOwner3 __vbaVarTstEq __vbaI2I4 __vbaObjVar DllFunctionCall __vbaVarLateMemSt _adj_fpatan __vbaLateIdCallLd __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release ord600 __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler __vbaStrToUnicode _adj_fprem _adj_fdivr_m64 __vbaI2Str ord608 __vbaFPException __vbaInStrVar __vbaStrVarVal __vbaVarCat __vbaI2Var ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaR8Str ord648 ord570 __vbaInStr __vbaVar2Vec __vbaNew2 __vbaVarLateMemCallLdRf ord571 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaVarSetVar __vbaI4Var ord610 __vbaVarAdd __vbaLateMemCall __vbaStrToAnsi ord612 __vbaVarDup __vbaVarCopy __vbaVarLateMemCallLd ord617 _CIatan __vbaStrMove _allmul _CItan __vbaVarForNext _CIexp __vbaMidStmtBstr ord580 __vbaFreeStr __vbaFreeObj ord581

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

8fa716e6d698cff761a257134fc0dcbc

msvbvm60

generic