b00905e4a6f2b0f184b3b762c7ba3dc5

Reason

config extraction: GuloaderBin: guloader: invalid shellcode

General

Target
b00905e4a6f2b0f184b3b762c7ba3dc5
Size 534KB
Sample240301-cd5lpsab7t
SHA256 a89f95715e64297820353a3669ace97c390ae8d14e6a65a84363b1e1998b08e2
MD5 b00905e4a6f2b0f184b3b762c7ba3dc5
SHA1 1147966e5c8807e504681f47b6a3746278193894
SHA512 7308d062665094542078ae653404b9b5768d66f6288c8d79f07994aaaafcaeb113fc52e9b6fef204c689f741265dfafd9da676207b6a2a841c7a98f9c45320ca
SSDEEP 6144:SJB57B72d0kjiTyHbc+as9qEFoHji7IQUhWO0rdF5JAoXMoM24KYsaf:YFKdSOKs9VF6ji73UhCJtMQrW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b00905e4a6f2b0f184b3b762c7ba3dc5

File Explorer

b00905e4a6f2b0f184b3b762c7ba3dc5

.exe 534KB

b00905e4a6f2b0f184b3b762c7ba3dc5

IMPHASH f317a0f9ecd288d0f17b31135f9c3819
SHA256 a89f95715e64297820353a3669ace97c390ae8d14e6a65a84363b1e1998b08e2
MD5 b00905e4a6f2b0f184b3b762c7ba3dc5
SHA1 1147966e5c8807e504681f47b6a3746278193894
SHA512 7308d062665094542078ae653404b9b5768d66f6288c8d79f07994aaaafcaeb113fc52e9b6fef204c689f741265dfafd9da676207b6a2a841c7a98f9c45320ca
SSDEEP 6144:SJB57B72d0kjiTyHbc+as9qEFoHji7IQUhWO0rdF5JAoXMoM24KYsaf:YFKdSOKs9VF6ji73UhCJtMQrW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8004

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaCyMul __vbaAryMove __vbaFreeVar ord588 __vbaStrVarMove __vbaLenBstr __vbaFreeVarList _adj_fdiv_m64 __vbaGetFxStr3 __vbaFreeObjList ord516 __vbaVarIndexLoadRef _adj_fprem1 __vbaRecAnsiToUni ord519 __vbaI4Sgn __vbaStrCat __vbaLsetFixstr __vbaRecDestruct __vbaSetSystemError __vbaHresultCheckObj ord665 _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct __vbaLateMemSt __vbaForEachCollObj ord593 __vbaExitProc __vbaBoolStr ord594 __vbaI4Abs __vbaOnError ord595 __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord599 __vbaStrFixstr __vbaBoolVar __vbaStrTextCmp __vbaVarTstLt _CIsin ord631 __vbaErase __vbaNextEachCollObj ord632 __vbaVarZero ord525 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord527 __vbaGenerateBoundsError ord529 __vbaGet3 __vbaStrCmp __vbaPutOwner3 __vbaAryConstruct2 __vbaVarTstEq __vbaCyI4 __vbaI2I4 __vbaObjVar DllFunctionCall __vbaVarLateMemSt __vbaCySub __vbaFpUI1 __vbaCastObjVar __vbaRedimPreserve _adj_fpatan __vbaFixstrConstruct __vbaR8Cy __vbaRedim __vbaRecUniToAnsi __vbaDerefAry EVENT_SINK_Release __vbaNew __vbaUI1I2 _CIsqrt __vbaObjIs EVENT_SINK_QueryInterface __vbaStr2Vec __vbaStrUI1 __vbaUI1I4 __vbaExceptHandler ord711 __vbaStrToUnicode _adj_fprem _adj_fdivr_m64 __vbaI2Str __vbaFailedFriend ord608 __vbaFPException __vbaInStrVar ord717 __vbaGetOwner3 __vbaUbound __vbaStrVarVal __vbaVarCat ord535 ord537 ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVar2Vec __vbaInStr ord648 __vbaNew2 __vbaR8Str __vbaVarLateMemCallLdRf _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaI4Str ord681 __vbaFreeStrList __vbaDerefAry1 _adj_fdivr_m32 ord577 __vbaPowerR8 _adj_fdiv_r ord578 ord100 __vbaVarTstNe __vbaI4Var __vbaVarLateMemStAd __vbaAryLock __vbaVarAdd __vbaLateMemCall __vbaStrToAnsi __vbaVarDup __vbaFpI2 ord616 __vbaVarCopy __vbaFpI4 __vbaVarLateMemCallLd __vbaRecDestructAnsi __vbaLateMemCallLd _CIatan __vbaAryCopy ord618 __vbaUI1Str __vbaCastObj __vbaStrMove ord619 __vbaR8IntI4 ord650 _allmul __vbaVarLateMemCallSt _CItan __vbaFPInt __vbaAryUnlock __vbaUI1Var _CIexp __vbaI4ErrVar __vbaFreeObj __vbaFreeStr ord581

Sharing

Errors

General

Malware Config

Signatures

File Explorer

b00905e4a6f2b0f184b3b762c7ba3dc5

msvbvm60

generic