kutaki | Tax Payment Receipt[.]zip

General

Target
Tax Payment Receipt.zip
Size 434KB
Sample240410-gmlmeaaa3v
SHA256 39a0e00b451da223a68e93feba38ebf9ab22c5b53d8c683020a431e75aee2b24
MD5 9f4e9e87cc9eaf70e854c1e536b455b5
SHA1 23d47f1fce8059aa934f001ac75d0bc305b95c48
SHA512 52fb26589148bc44ff6c6daad0cf1e03095d15ea19b93432b0f5af1beef6d9389e6114a02047f49fb512feb726d5d1d238da526c55cd3e497c9f573fdcd114ae
SSDEEP 12288:F1O+cV5qy07nR2Lnk4cA9jWv/mhurmMS+8qkn9tUWLQ:nCVl01EJWv/M1MS+8qknrUWLQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://linkwotowoto.club/new/two.php

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
static1/unpack001/Tax Payment Receipt.exe	family_kutaki

Kutaki family
kutaki

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Tax Payment Receipt.exe

File Explorer

Tax Payment Receipt.zip

.zip 434KB
Tax Payment Receipt.exe

.exe 877KB

Tax Payment Receipt.zip

SHA256 39a0e00b451da223a68e93feba38ebf9ab22c5b53d8c683020a431e75aee2b24
MD5 9f4e9e87cc9eaf70e854c1e536b455b5
SHA1 23d47f1fce8059aa934f001ac75d0bc305b95c48
SHA512 52fb26589148bc44ff6c6daad0cf1e03095d15ea19b93432b0f5af1beef6d9389e6114a02047f49fb512feb726d5d1d238da526c55cd3e497c9f573fdcd114ae
SSDEEP 12288:F1O+cV5qy07nR2Lnk4cA9jWv/mhurmMS+8qkn9tUWLQ:nCVl01EJWv/M1MS+8qknrUWLQ
MD5 SHA1 SHA512 SSDEEP

Tax Payment Receipt.exe

IMPHASH c447e0e07ff07dc45e034d8debe2ba17
SHA256 7757fb2455891d1cbcf89ca3cdf291bacaee9c3f1835826a4831c49fbd8249f1
MD5 cac42f0744e58164039fbc2ef62da404
SHA1 85e2ffe52fb62712a110cf8d9d2d6fa6269306b6
SHA512 64cd76c4d78b2e0dd1c2e5a96fc71426c06b3584e4ff61e0aed3f7de88c9e573f96b9c3aaf2f27fce3514093adbd8a0f1f3d8479438b0fd8bb1fb064365a6e85
SSDEEP 12288:5xP/62UAecZ/n6Z5P3Z8sO46A9jmP/uhu/yMS08CkntxYRkL:v6vAZZ/6bisZfmP/UDMS08Ckn37
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Kutaki Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17360

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaVarTstGt ord690 __vbaStrI2 _CIcos _adj_fptan __vbaHresultCheck __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLateIdCall __vbaStrVarMove ord588 __vbaLenBstr ord696 __vbaPut3 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaRaiseEvent __vbaFreeObjList ord516 __vbaStrErrVarCopy __vbaVarIndexLoadRef ord517 _adj_fprem1 ord518 ord626 ord519 __vbaI2Abs __vbaCopyBytes __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat ord660 __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar ord667 __vbaAryDestruct __vbaVarIndexLoadRefLock ord591 ord593 __vbaExitProc __vbaVarForInit ord300 ord594 ord595 __vbaOnError __vbaObjSet ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord599 ord306 ord520 __vbaBoolVar __vbaRefVarAry __vbaFpR8 __vbaBoolVarNull _CIsin ord631 __vbaErase __vbaVargVarMove ord525 __vbaVarCmpGt ord632 __vbaChkstk __vbaFileClose ord526 __vbaCyVar EVENT_SINK_AddRef __vbaGenerateBoundsError ord528 ord529 __vbaGet3 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaObjVar __vbaI2I4 DllFunctionCall ord670 __vbaVarLateMemSt ord563 __vbaVarOr ord564 __vbaCastObjVar __vbaLbound _adj_fpatan __vbaLateIdCallLd __vbaR8Cy __vbaStrR8 __vbaRedim EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaVarAnd __vbaObjIs EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 ord712 __vbaPrintFile __vbaStrToUnicode ord713 _adj_fprem _adj_fdivr_m64 ord607 ord714 __vbaLateIdStAd ord608 __vbaFPException __vbaInStrVar ord717 __vbaStrVarVal __vbaUbound __vbaVarCat __vbaI2Var ord537 ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVar2Vec ord648 ord570 __vbaVarLateMemCallLdRf __vbaR8Str __vbaNew2 __vbaInStr _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy ord681 __vbaI4Str __vbaVarCmpLt __vbaFreeStrList ord576 __vbaDerefAry1 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var __vbaVarLateMemStAd ord689 __vbaVarCmpEq __vbaFpCy __vbaVarAdd __vbaLateMemCall __vbaAryLock __vbaStrComp __vbaVarDup __vbaStrToAnsi __vbaVerifyVarObj __vbaFpI2 ord616 __vbaVarLateMemCallLd __vbaFpI4 ord617 __vbaLateMemCallLd _CIatan ord618 __vbaAryCopy __vbaCastObj __vbaStrMove ord619 __vbaR8IntI4 __vbaStrVarCopy __vbaForEachVar _allmul __vbaLateIdSt _CItan ord546 __vbaNextEachCollAd __vbaUI1Var __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing