kutaki | ed0405b43cbd51aa243dc1d8944258f0N | Triage

Sharing

General

Target

ed0405b43cbd51aa243dc1d8944258f0N
Size

2.4MB
MD5

ed0405b43cbd51aa243dc1d8944258f0
SHA1

ad61b54b543878a93cb073d88c53620dd06f440d
SHA256

efea2c3468ab3b4a39ea352f4f9405410ac586b7cfe7b4e196346ffc06612c73
SHA512

e4472638d19e9d0ac14181bf17881cc8772fc1147d2a9382de54d2a8fb230879b5ccea1db856f17d960436a8d86dc2a98bf119013afd4be520e3c51ca94e4483
SSDEEP

49152:OiYYHtp2WGmZOB1b57nxG9ijgQO1PMDozYAPz2U:jzHtcpmZAb57nxGRMDoMu2

Score

10^/10

kutaki

Malware Config

Signatures

Kutaki Executable 1 IoCs

Processes:

resource yara_rule

sample family_kutaki
Kutaki family
kutaki
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

ed0405b43cbd51aa243dc1d8944258f0N

Files

ed0405b43cbd51aa243dc1d8944258f0N
.exe windows:4 windows x86 arch:x86

6aa12ad0bde715786163fb64684158dc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord516
ord517
ord518
ord519
ord666
ord667
ord593
ord300
ord594
ord595
ord598
ord306
ord520
ord632
ord525
ord526
EVENT_SINK_AddRef
ord528
ord529
DllFunctionCall
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
ord713
ord606
ord608
ord716
ord717
ProcCallEngine
ord535
ord644
ord537
ord645
ord648
ord570
ord573
ord681
ord578
ord685
ord100
ord616
ord617
ord618
ord619
ord650
ord581

Sections

.text
Size: 292KB - Virtual size: 290KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ