4bf1d3f23884d483527614a137f2c268f320cad287f1d95b945fbd859f587cfe

Sharing

Copy URL

Twitter E-mail

General

Target

4bf1d3f23884d483527614a137f2c268f320cad287f1d95b945fbd859f587cfe
Size

3.5MB
MD5

44a96f20d54d1bc90a02405def4c37fb
SHA1

20ed2f1d329db441efb07e3906209d168051f993
SHA256

4bf1d3f23884d483527614a137f2c268f320cad287f1d95b945fbd859f587cfe
SHA512

de256744a2bb0eabf3d29279de322b1eed1fe6e95e3058cff3a9c57dc6b4fd548e9a737f094fc06fd2d8706ff668d70c0c5b68dd86b290e9ef54892d6bd20a8f
SSDEEP

49152:7aya0iiD4O7wktyfkQQ4tiPgJzyy7TdyKsGPXnstfJixJlidxPwsdMogYhC/ZjYD:7paeNE04fQAVWytykktRJd6XoghRmz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4bf1d3f23884d483527614a137f2c268f320cad287f1d95b945fbd859f587cfe

Files

4bf1d3f23884d483527614a137f2c268f320cad287f1d95b945fbd859f587cfe
.exe windows:4 windows x86 arch:x86

b89465c071d414ffd50536a4086d5f08

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
VirtualFree
VirtualProtect
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateFileA
CreateFileW
WriteFile
CloseHandle
GetLocalTime
VirtualQuery
CreateFileMappingW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
FlushInstructionCache
GetSystemInfo
VirtualProtectEx

user32

wsprintfA

shlwapi

ord158

msvbvm60

EVENT_SINK_GetIDsOfNames
__vbaStrI2
__vbaLateIdCall
__vbaVarIndexStore
__vbaLineInputVar
__vbaStrCat
__vbaInStrVarB
ord660
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
__vbaVarTstLe
__vbaVarCmpGe
__vbaVarForInit
__vbaI4Abs
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
__vbaFpR4
__vbaStrFixstr
__vbaFpR8
__vbaErase
__vbaFileClose
__vbaVarAbs
__vbaExitEachColl
__vbaStrCmp
__vbaObjVar
__vbaVarLateMemSt
__vbaStrR8
__vbaNew
__vbaUI1I2
_CIsqrt
__vbaVarMul
__vbaStrToUnicode
__vbaDateStr
__vbaVarDiv
ord608
__vbaVarCmpLe
__vbaInStrVar
__vbaUbound
__vbaVarCat
__vbaCheckType
_CIlog
__vbaVarLateMemCallLdRf
_adj_fdiv_m32i
__vbaVarSetObj
__vbaVarNot
_adj_fdivr_m32
__vbaVarTstNe
__vbaVarCmpEq
__vbaAryLock
__vbaStrToAnsi
__vbaFpI2
__vbaVarTstGe
__vbaCastObj
__vbaVarNeg
_allmul
_CItan
__vbaFPInt

Sections

.text
Size: - Virtual size: 13.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 300KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.virbox
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vdata0
Size: - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vdata1
Size: - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.virbox3
Size: 220KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b89465c071d414ffd50536a4086d5f08

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

msvbvm60

Sections

.text Size: - Virtual size: 13.7MB

.data Size: - Virtual size: 300KB

.virbox Size: - Virtual size: 1.7MB

.vdata0 Size: - Virtual size: 161KB

.vdata1 Size: - Virtual size: 171KB

.virbox3 Size: 220KB - Virtual size: 218KB

.rsrc Size: 8KB - Virtual size: 7KB

.text
Size: - Virtual size: 13.7MB

.data
Size: - Virtual size: 300KB

.virbox
Size: - Virtual size: 1.7MB

.vdata0
Size: - Virtual size: 161KB

.vdata1
Size: - Virtual size: 171KB

.virbox3
Size: 220KB - Virtual size: 218KB

.rsrc
Size: 8KB - Virtual size: 7KB