3703d8ddefe9bc0f1e26e51f41a31265ea804c5cc1e40e9199aedacf38d7cb31

Reason

config extraction: GuloaderBin: guloader: invalid shellcode

General

Target
3703d8ddefe9bc0f1e26e51f41a31265ea804c5cc1e40e9199aedacf38d7cb31
Size 83KB
Sample240901-zer4bs1cml
SHA256 3703d8ddefe9bc0f1e26e51f41a31265ea804c5cc1e40e9199aedacf38d7cb31
MD5 f2ae976a2a0e63e517b48e00d4114ab0
SHA1 b3dbf07b81bcd7c45266b66cf0a7056a44df5546
SHA512 485a6cf4deac2ccdb460467f8f68cbd0d9c40e5c5592a272334fc53eb3a0d41df828ea6590d4ba54b8f0840dff7bf1b372eed6fd2e6a108f0289f531aa62672f
SSDEEP 1536:5AhBJs3t0CwEr1dPWOedM31n5ycDpm+l+YxgLI5JNOzhO23k/PLJnaD9PsQtB:GUtcE3PWHK1FdlLxp5JNOzhO2U1naB3j
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack003/PO-DDC50015.exe

File Explorer

3703d8ddefe9bc0f1e26e51f41a31265ea804c5cc1e40e9199aedacf38d7cb31

.zip 83KB
8ce21356d57afd041db3b68f0247cfaaf553d8708b302b8e8164d720726fbeff

.eml 118KB
PO-DDC50015.rar

.rar 43KB
PO-DDC50015.exe

.exe 104KB
email-html-1.txt

.html 5KB

3703d8ddefe9bc0f1e26e51f41a31265ea804c5cc1e40e9199aedacf38d7cb31

SHA256 3703d8ddefe9bc0f1e26e51f41a31265ea804c5cc1e40e9199aedacf38d7cb31
MD5 f2ae976a2a0e63e517b48e00d4114ab0
SHA1 b3dbf07b81bcd7c45266b66cf0a7056a44df5546
SHA512 485a6cf4deac2ccdb460467f8f68cbd0d9c40e5c5592a272334fc53eb3a0d41df828ea6590d4ba54b8f0840dff7bf1b372eed6fd2e6a108f0289f531aa62672f
SSDEEP 1536:5AhBJs3t0CwEr1dPWOedM31n5ycDpm+l+YxgLI5JNOzhO23k/PLJnaD9PsQtB:GUtcE3PWHK1FdlLxp5JNOzhO2U1naB3j
MD5 SHA1 SHA512 SSDEEP

Password

infected

PO-DDC50015.exe

IMPHASH 482c290d00195d58231cc349b5120e89
SHA256 be869d17ee3a219c47d0d68cb6a17086ec8bfd2b189d0cd0fc79b1f0523a2df6
MD5 23496e58bf5655705616fe393b7d5adc
SHA1 50e3dacdc7be16d0adbe4cc2b1d9df5b941ae686
SHA512 12f763ae5a6ef1dd3dc7712e1939332791906bc0d668f29ccbbb5879878bd0ccd4d8d6e025b8f5dc45e138486edd9daad0e6ea5d8f51c8285e3bbd9c0b2bcbdd
SSDEEP 1536:yOHrFHi8FgGsGqr/MO1roiuKVovoW1W+zBJDbB5/Z6hl:VL1i8KGsGsT1roihdW4+tJx5M
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

ord690 _CIcos _adj_fptan __vbaVarMove __vbaFreeVar __vbaStrVarMove __vbaFreeVarList _adj_fdiv_m64 __vbaFreeObjList _adj_fprem1 __vbaRecAnsiToUni __vbaSetSystemError ord554 __vbaRecDestruct __vbaHresultCheckObj _adj_fdiv_m32 ord559 ord667 __vbaAryDestruct __vbaExitProc ord594 __vbaOnError __vbaObjSet ord595 ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 ord704 ord705 __vbaFPFix __vbaFpR8 _CIsin __vbaChkstk EVENT_SINK_AddRef __vbaObjVar __vbaI2I4 DllFunctionCall _adj_fpatan __vbaLateIdCallLd __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release ord679 __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler __vbaStrToUnicode _adj_fprem _adj_fdivr_m64 __vbaVarErrI4 __vbaFPException ord532 __vbaStrVarVal ord535 ord536 _CIlog ord539 __vbaErrorOverflow __vbaNew2 __vbaR8Str ord648 _adj_fdiv_m32i _adj_fdivr_m32i ord680 __vbaStrCopy __vbaI4Str __vbaFreeStrList __vbaDerefAry1 _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var ord610 __vbaLateMemCall ord611 __vbaStrToAnsi __vbaVarDup ord613 __vbaFpI4 __vbaLateMemCallLd __vbaRecDestructAnsi _CIatan __vbaStrMove ord540 ord541 ord543 _allmul __vbaLateIdSt _CItan ord546 _CIexp __vbaFreeObj __vbaFreeStr

Sharing

Errors

General

Malware Config

Signatures

File Explorer

3703d8ddefe9bc0f1e26e51f41a31265ea804c5cc1e40e9199aedacf38d7cb31

8ce21356d57afd041db3b68f0247cfaaf553d8708b302b8e8164d720726fbeff

PO-DDC50015.rar

PO-DDC50015.exe

msvbvm60

generic

email-html-1.txt