638b6cb2470788a51b6c55859526b160N[.]exe

Reason

config extraction: GuloaderBin: guloader: invalid shellcode

General

Target
638b6cb2470788a51b6c55859526b160N.exe
Size 154KB
Sample240822-trrensyflq
SHA256 09fb6ec8522a119b0f77ecc7851dcc5664ba82d99ed86518a2fb46843040a0c4
MD5 638b6cb2470788a51b6c55859526b160
SHA1 9a3d8ad790aea3faebbfe49ef2fe3913dbb64ae3
SHA512 a244a1f06d808e76113d149a61fc32a9385f7dc15b36ac22736768efa5035d423462e83ae367ca68bcc24d95622fb14f19595d235ca036521d2d5be73af4c7c9
SSDEEP 1536:+/nLoT+zOOi0iJRdDP348+3AIe5+8GPcPiAbj/tNFmqThGm8ll+ZNKL6GRkfX7qF:+/5wJR6LTQTGPcaaDxd8uZUL6GIZ9Y
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
638b6cb2470788a51b6c55859526b160N.exe

File Explorer

638b6cb2470788a51b6c55859526b160N.exe

.exe 154KB

638b6cb2470788a51b6c55859526b160N.exe

IMPHASH 1664af5ac7fee4e909bf4c17d2553a4f
SHA256 09fb6ec8522a119b0f77ecc7851dcc5664ba82d99ed86518a2fb46843040a0c4
MD5 638b6cb2470788a51b6c55859526b160
SHA1 9a3d8ad790aea3faebbfe49ef2fe3913dbb64ae3
SHA512 a244a1f06d808e76113d149a61fc32a9385f7dc15b36ac22736768efa5035d423462e83ae367ca68bcc24d95622fb14f19595d235ca036521d2d5be73af4c7c9
SSDEEP 1536:+/nLoT+zOOi0iJRdDP348+3AIe5+8GPcPiAbj/tNFmqThGm8ll+ZNKL6GRkfX7qF:+/5wJR6LTQTGPcaaDxd8uZUL6GIZ9Y
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

ord582 ord690 _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaHresultCheck __vbaFreeVar ord587 __vbaAryMove __vbaStrVarMove ord696 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 ord513 __vbaFreeObjList _adj_fprem1 ord518 ord519 ord629 ord552 ord554 __vbaSetSystemError __vbaHresultCheckObj __vbaLenBstrB ord663 ord557 _adj_fdiv_m32 ord666 ord667 __vbaAryDestruct ord591 ord594 __vbaOnError __vbaObjSet ord595 _adj_fdiv_m16i __vbaObjSetAddref ord702 _adj_fdivr_m16i ord703 ord598 ord704 ord705 ord706 ord522 __vbaFpR8 _CIsin ord631 __vbaChkstk EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp __vbaAryConstruct2 ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord564 _adj_fpatan ord676 EVENT_SINK_Release __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler ord713 ord606 _adj_fprem _adj_fdivr_m64 ord607 ord531 __vbaFPException ord717 ord532 ord534 ord535 ord536 _CIlog ord646 ord539 __vbaNew2 ord648 __vbaVar2Vec __vbaInStr ord571 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaVarTstNe ord689 ord610 ord611 __vbaVarDup __vbaStrToAnsi ord612 ord614 ord615 __vbaFpI4 __vbaLateMemCallLd _CIatan __vbaStrMove __vbaCastObj ord541 _allmul _CItan ord546 _CIexp __vbaFreeStr __vbaFreeObj

Sharing

Errors