fab6979844dc83439ddd089075eb7fcf9906cdfa63ed4f9ec6d430c38fd880f7

Sharing

Copy URL Twitter E-mail

General

Target

fab6979844dc83439ddd089075eb7fcf9906cdfa63ed4f9ec6d430c38fd880f7
Size

12.8MB
MD5

60cd16a79656c9be8fae2bc873fba828
SHA1

15985e4c8d111a0c39c6574b1eb2612111d26d76
SHA256

fab6979844dc83439ddd089075eb7fcf9906cdfa63ed4f9ec6d430c38fd880f7
SHA512

472c1a771b655ca33634b63f6370ccc3a9aae8b33583bb78a848c072eef661b29bd5d1efa0de496785ff7e5c1021ab7fc87309085cb4d2c6c2f5583d8fb9a6eb
SSDEEP

393216:4J/4DyRn6Sc4sRxT4VSM5IO2PKcraET1A:4J/4DyRLsRxW/KO2PKVExA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fab6979844dc83439ddd089075eb7fcf9906cdfa63ed4f9ec6d430c38fd880f7

Files

fab6979844dc83439ddd089075eb7fcf9906cdfa63ed4f9ec6d430c38fd880f7
.exe windows:4 windows x86 arch:x86

074399a6d24370803b047993cc7ee1e5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
VirtualFree
VirtualProtect
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateFileA
CreateFileW
WriteFile
CloseHandle
GetLocalTime
VirtualQuery
CreateFileMappingW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
FlushInstructionCache
GetSystemInfo
VirtualProtectEx

user32

wsprintfA

shlwapi

ord158

msvbvm60

EVENT_SINK_GetIDsOfNames
__vbaVarSub
__vbaStrI2
_CIcos
__vbaVarMove
__vbaAryMove
__vbaVarIdiv
__vbaFreeVarList
__vbaNextEachVar
__vbaLineInputVar
__vbaStrErrVarCopy
__vbaRecAnsiToUni
__vbaI2Abs
__vbaRecDestruct
__vbaVargVarCopy
__vbaVarCmpGe
__vbaVarIndexLoadRefLock
__vbaBoolStr
__vbaFileCloseAll
__vbaCyAdd
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
__vbaVarIndexLoad
__vbaFpR4
__vbaStrFixstr
__vbaBoolVar
__vbaRefVarAry
__vbaErase
__vbaLateMemStAd
__vbaVarCmpGt
__vbaVarAbs
__vbaStrCmp
__vbaPutOwner3
__vbaNextEachCollVar
__vbaVarLateMemSt
__vbaFpUI1
__vbaR4Cy
__vbaR8Cy
__vbaNew
__vbaUI1I2
__vbaVarAnd
__vbaStr2Vec
__vbaPrintFile
__vbaR4ErrVar
_adj_fprem
__vbaGosub
__vbaVarDiv
__vbaVarCmpLe
__vbaFPException
__vbaInStrVar
__vbaGetOwner3
__vbaLsetFixstrFree
_CIlog
__vbaVar2Vec
__vbaVarLateMemCallLdRf
__vbaVarInt
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarCmpLt
__vbaVarTstNe
__vbaAryLock
__vbaFreeVarg
__vbaVarDup
__vbaVerifyVarObj
__vbaOnGoCheck
__vbaVarLateMemCallLd
_CIatan
__vbaAryCopy
__vbaStrVarCopy
_allmul
__vbaLateIdSt
_CItan
__vbaFPInt
__vbaFreeObj

Sections

.text
Size: - Virtual size: 31.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.virbox
Size: - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vdata0
Size: - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vdata1
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.virbox3
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 176KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

074399a6d24370803b047993cc7ee1e5

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

msvbvm60

Sections

.text Size: - Virtual size: 31.4MB

.data Size: - Virtual size: 1.0MB

.virbox Size: - Virtual size: 4.3MB

.vdata0 Size: - Virtual size: 4.6MB

.vdata1 Size: - Virtual size: 13KB

.virbox3 Size: 220KB - Virtual size: 219KB

.rsrc Size: 176KB - Virtual size: 173KB

.text
Size: - Virtual size: 31.4MB

.data
Size: - Virtual size: 1.0MB

.virbox
Size: - Virtual size: 4.3MB

.vdata0
Size: - Virtual size: 4.6MB

.vdata1
Size: - Virtual size: 13KB

.virbox3
Size: 220KB - Virtual size: 219KB

.rsrc
Size: 176KB - Virtual size: 173KB