d6f0aa22a57ebc3eef3b1e2b45e629ff1fe68213d0e52a5171864586dbf99800N

General

Target
d6f0aa22a57ebc3eef3b1e2b45e629ff1fe68213d0e52a5171864586dbf99800N
Size 188KB
Sample241103-b5d3dstrel
SHA256 d6f0aa22a57ebc3eef3b1e2b45e629ff1fe68213d0e52a5171864586dbf99800
MD5 28edd9e686dd3b3c43dbbc9d7a4c2d10
SHA1 9896f16db1c097eee70f5d90b3b34ca7a0cc0c1c
SHA512 09e205080d1f6fd2fe2783749a518e1a6085c85deca92c67a003c4f7445c3d4e700ac7d90d70738dd5330fbb8040bc90e93c7ede8cf416e495e84ab7693243b3
SSDEEP 3072:Iy3pOBC3bEpqavBSPcC2ScrgCjlyKOanF9t6xtZYwlslG9:Iy3pOBC3wpqavBSPcC2ScrgCCs3o7lsI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6f0aa22a57ebc3eef3b1e2b45e629ff1fe68213d0e52a5171864586dbf99800N

File Explorer

d6f0aa22a57ebc3eef3b1e2b45e629ff1fe68213d0e52a5171864586dbf99800N

.exe 188KB

d6f0aa22a57ebc3eef3b1e2b45e629ff1fe68213d0e52a5171864586dbf99800N

IMPHASH a4907116c1f567ab9bb5e3979d24b0b8
SHA256 d6f0aa22a57ebc3eef3b1e2b45e629ff1fe68213d0e52a5171864586dbf99800
MD5 28edd9e686dd3b3c43dbbc9d7a4c2d10
SHA1 9896f16db1c097eee70f5d90b3b34ca7a0cc0c1c
SHA512 09e205080d1f6fd2fe2783749a518e1a6085c85deca92c67a003c4f7445c3d4e700ac7d90d70738dd5330fbb8040bc90e93c7ede8cf416e495e84ab7693243b3
SSDEEP 3072:Iy3pOBC3bEpqavBSPcC2ScrgCjlyKOanF9t6xtZYwlslG9:Iy3pOBC3wpqavBSPcC2ScrgCCs3o7lsI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7520

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaPut3 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 __vbaRaiseEvent __vbaNextEachVar __vbaFreeObjList ord516 _adj_fprem1 __vbaStrCat __vbaVarCmpNe __vbaRecDestruct __vbaSetSystemError __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryDestruct __vbaExitProc __vbaVarForInit ord595 __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaVargVar __vbaBoolVarNull _CIsin ord525 __vbaVarZero ord632 __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef __vbaGenerateBoundsError ord528 ord529 __vbaStrCmp __vbaGet3 __vbaAryConstruct2 __vbaPutOwner3 __vbaVarTstEq __vbaI2I4 __vbaObjVar DllFunctionCall __vbaVarOr ord670 __vbaRedimPreserve _adj_fpatan __vbaLateIdCallLd __vbaRedim EVENT_SINK_Release ord600 __vbaUI1I2 _CIsqrt __vbaVarAnd EVENT_SINK_QueryInterface __vbaExceptHandler __vbaStrToUnicode __vbaPrintFile _adj_fprem _adj_fdivr_m64 ord607 ord608 ord716 __vbaFPException ord717 __vbaInStrVar __vbaGetOwner3 __vbaUbound __vbaStrVarVal __vbaVarCat ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord648 __vbaVar2Vec ord570 __vbaVarLateMemCallLdRf __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaI4Str __vbaFreeStrList __vbaVarNot _adj_fdivr_m32 _adj_fdiv_r ord578 ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaVarCmpEq __vbaAryLock __vbaLateMemCall __vbaVarAdd ord612 __vbaStrToAnsi __vbaVarDup __vbaFpI4 ord616 __vbaVarLateMemCallLd ord617 _CIatan ord618 __vbaStrMove __vbaR8IntI4 __vbaForEachVar _allmul _CItan __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord580

Sharing

General

Malware Config

Signatures

File Explorer

d6f0aa22a57ebc3eef3b1e2b45e629ff1fe68213d0e52a5171864586dbf99800N

msvbvm60

generic