d2f7f281060952c6f8f98bfc3611a08613ef37576daec2473cf2d01b1c5317d6

Sharing

Copy URL

Twitter E-mail

General

Target

d2f7f281060952c6f8f98bfc3611a08613ef37576daec2473cf2d01b1c5317d6
Size

3.3MB
MD5

f8c55a14d42dd3dc8190d6adb0ff1537
SHA1

d118229ceb16c23a5c50d7fe4bb10accfaad55f6
SHA256

d2f7f281060952c6f8f98bfc3611a08613ef37576daec2473cf2d01b1c5317d6
SHA512

654cd6f692af11b3468eaed6a595787120a68502c449d2a74b035745af901e67d3cfe2243cb80f6389334c6d9daf2ffe660366e1b5deee85619bd784a682e20d
SSDEEP

98304:nMmFYPYB+Goxo49+qlzqG8KbSEHPY3cGoU:Mm9tt49VqGXbrHU1z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2f7f281060952c6f8f98bfc3611a08613ef37576daec2473cf2d01b1c5317d6

Files

d2f7f281060952c6f8f98bfc3611a08613ef37576daec2473cf2d01b1c5317d6
.exe windows:4 windows x86 arch:x86

47414c7177530dbebdcd31fece3c60d5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
VirtualFree
VirtualProtect
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateFileA
CreateFileW
WriteFile
CloseHandle
GetLocalTime
VirtualQuery
CreateFileMappingW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
FlushInstructionCache
GetSystemInfo
VirtualProtectEx

user32

wsprintfA

shlwapi

ord158

msvbvm60

EVENT_SINK_GetIDsOfNames
_CIcos
__vbaLenBstr
__vbaVarIndexStore
__vbaFreeObjList
__vbaStrCat
__vbaLsetFixstr
ord660
__vbaRecDestruct
__vbaNameFile
__vbaLenVar
__vbaAryVar
__vbaAryDestruct
__vbaVarForInit
__vbaI4Abs
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
__vbaFpR4
__vbaStrFixstr
__vbaRefVarAry
__vbaErase
__vbaFileClose
__vbaVarAbs
__vbaExitEachColl
__vbaStrCmp
__vbaObjVar
__vbaVarLateMemSt
__vbaRedim
__vbaNew
__vbaUI1I2
_CIsqrt
__vbaVarMul
__vbaPrintFile
__vbaDateStr
__vbaI2Str
ord608
__vbaVarCmpLe
__vbaInStrVar
__vbaStrVarVal
__vbaCheckType
_CIlog
__vbaVarLateMemCallLdRf
_adj_fdiv_m32i
__vbaVarSetObj
__vbaVarNot
_adj_fdivr_m32
__vbaVarTstNe
__vbaLateMemCall
__vbaVarDup
__vbaFpI2
__vbaFpI4
__vbaStrMove
__vbaVarNeg
_allmul
_CItan
__vbaFPInt

Sections

.text
Size: - Virtual size: 13.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 300KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.virbox
Size: - Virtual size: 471KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vdata0
Size: - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vdata1
Size: - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.virbox3
Size: 220KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47414c7177530dbebdcd31fece3c60d5

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

msvbvm60

Sections

.text Size: - Virtual size: 13.5MB

.data Size: - Virtual size: 300KB

.virbox Size: - Virtual size: 471KB

.vdata0 Size: - Virtual size: 161KB

.vdata1 Size: - Virtual size: 106KB

.virbox3 Size: 220KB - Virtual size: 218KB

.rsrc Size: 8KB - Virtual size: 7KB

.text
Size: - Virtual size: 13.5MB

.data
Size: - Virtual size: 300KB

.virbox
Size: - Virtual size: 471KB

.vdata0
Size: - Virtual size: 161KB

.vdata1
Size: - Virtual size: 106KB

.virbox3
Size: 220KB - Virtual size: 218KB

.rsrc
Size: 8KB - Virtual size: 7KB