af2d72fc2c8e4b4a6b7be2d7b5806d37ffc13b27d2a210ffffcc8c963862e184[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

af2d72fc2c8e4b4a6b7be2d7b5806d37ffc13b27d2a210ffffcc8c963862e184.exe
Size

2.6MB
MD5

a5bee6a7836dcd947ff0159da4ca0b29
SHA1

9f86f98d5777bc73753cc5a70a2f259b8e1b9e82
SHA256

af2d72fc2c8e4b4a6b7be2d7b5806d37ffc13b27d2a210ffffcc8c963862e184
SHA512

6afc31772009ed4ee6e4ba9733b563bc379a47491cea633054cdce4e6f8798456d202171f212b3572e6d88c90d6d8a1ffff5f484707e5186e0b170ab6f8167e7
SSDEEP

49152:PYbdYAm4zEbdYAm4zXbdYAm4zKbdYAm4zFbdYAm4zB3An3AI3AJ3AiW538r/39vG:PSdrWdrrdrAdr1drlA3AaAtAuv9vpn43

Score

1^/10

Malware Config

Signatures

Files

af2d72fc2c8e4b4a6b7be2d7b5806d37ffc13b27d2a210ffffcc8c963862e184.exe
.exe windows:4 windows x86 arch:x86

c8ba23b6b87d52f10b27f48f2f6aa725

Code Sign

33:00:00:04:a8:82:e6:b8:ac:1c:5d:5f:f0:00:00:00:00:04:a8
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2024, 20:04

Not After

11/09/2025, 20:04

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

12:d6:d8:0b:fd:03:73:b5:cf:f6:38:f0:5c:fb:e2:af:7a:e7:be:93:4b:23:90:3f:fb:4b:4b:95:2d:36:7a:21
Signer

Actual PE Digest

12:d6:d8:0b:fd:03:73:b5:cf:f6:38:f0:5c:fb:e2:af:7a:e7:be:93:4b:23:90:3f:fb:4b:4b:95:2d:36:7a:21

Digest Algorithm

sha256

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
RtlMoveMemory
GetModuleHandleW

msvbvm60

__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
__vbaAryMove
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
_adj_fdiv_m64
ord698
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryDestruct
ord595
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaRefVarAry
__vbaBoolVarNull
_CIsin
__vbaVargVarMove
__vbaVarCmpGt
ord632
__vbaChkstk
EVENT_SINK_AddRef
__vbaAryConstruct2
__vbaVarTstEq
ord638
DllFunctionCall
__vbaVarOr
__vbaRedimPreserve
_adj_fpatan
__vbaRedim
EVENT_SINK_Release
__vbaNew
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaStrVarVal
__vbaUbound
__vbaVarCat
__vbaI2Var
ord644
_CIlog
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
__vbaAryLock
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
__vbaFpI2
__vbaVarCopy
ord616
_CIatan
__vbaStrMove
__vbaCastObj
__vbaStrVarCopy
_allmul
_CItan
ord653
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 469KB - Virtual size: 469KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8ba23b6b87d52f10b27f48f2f6aa725

Code Sign

33:00:00:04:a8:82:e6:b8:ac:1c:5d:5f:f0:00:00:00:00:04:a8Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

12:d6:d8:0b:fd:03:73:b5:cf:f6:38:f0:5c:fb:e2:af:7a:e7:be:93:4b:23:90:3f:fb:4b:4b:95:2d:36:7a:21Signer

Headers

File Characteristics

Imports

kernel32

msvbvm60

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.data Size: 469KB - Virtual size: 469KB

.data Size: 7KB - Virtual size: 7KB

.rsrc Size: 66KB - Virtual size: 66KB

33:00:00:04:a8:82:e6:b8:ac:1c:5d:5f:f0:00:00:00:00:04:a8
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

12:d6:d8:0b:fd:03:73:b5:cf:f6:38:f0:5c:fb:e2:af:7a:e7:be:93:4b:23:90:3f:fb:4b:4b:95:2d:36:7a:21
Signer

.text
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 469KB - Virtual size: 469KB

.data
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 66KB - Virtual size: 66KB