9699bee4b70c0f9273e05968c0872c2e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9699bee4b70c0f9273e05968c0872c2e
Size

96KB
MD5

9699bee4b70c0f9273e05968c0872c2e
SHA1

d450fcd28cbb24ee2f4473fbe1a0c4d0d1a67dd9
SHA256

35b67d2f39d633e14f40589cd348a9efcff1676f76b666d1070629361340b9b7
SHA512

6754ded7a772aa05644c91a920bc6f56cb0d8afad85313f95b083f2a522d674554cf8f6fc5ab5061f85b8b952e43e797f86f73ed3eb47ab35939ee5593f57565
SSDEEP

1536:sQ8XEqmOJf7IlSBnoWOICK52y/1Mnp0Zm:x8XEqmOJfNaKR52ymnp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9699bee4b70c0f9273e05968c0872c2e

Files

9699bee4b70c0f9273e05968c0872c2e
.exe windows:4 windows x86 arch:x86

4dfaa0e656ad3f200669e1730bf77b08

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW

kernel32

WaitForSingleObject
CreateEventW
SetEvent
CloseHandle

msvbvm60

EVENT_SINK_GetIDsOfNames
ord693
ord694
MethCallEngine
EVENT_SINK_Invoke
ord516
Zombie_GetTypeInfo
ord592
ord593
ord594
ord595
ord598
ord520
ord631
ord632
ord525
EVENT_SINK_AddRef
ord529
ord561
DllFunctionCall
ord563
Zombie_GetTypeInfoCount
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord710
ord711
ord712
ord606
ord607
ord714
ord608
ord717
ord319
ProcCallEngine
ord537
ord644
ord570
ord573
ord681
ord685
ord100
ord320
ord321
ord616
ord617
ord618
ord650
ord546
ord580
ord581

Sections

.text
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ