galloflavine[.]exe

General

Target
galloflavine.exe
Size 396KB
Sample260113-qa671sgw3a
SHA256 8a34536561cfbe3a86c88ef96040db62a93b8a9fc80d28ebb4d44824b1122be3
MD5 55f470e2603340e31a9e0b6278ec2ea6
SHA1 b9a2ed57f3187fff7e954c2079af298ca428769f
SHA512 18bad95a2f247bbb5e5175a192f9be3e607d45b5cfbf6cfda17c73a0367cb905e7d884dd18aaf850729c08da034a59d39596c5d506a29aa72ccad426666eaa57
SSDEEP 6144:h3CpPcS8ZDFHZcEH8gs8Vz2JjC0Ipmp14Be2jAko/+mSDTJqXTTwm3zgukF9BQsB:AcFs8Vz2JjC0Iq+YgoGDDTJkTH8j9B
TLSH
T16384E416E650B0A5F8A348702D79A256792C3D3A3680EC4BB78D9F5A377168370F532F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
galloflavine.exe

File Explorer

galloflavine.exe

.exe 396KB

galloflavine.exe

IMPHASH 834b4b2818eb10e38435b81881b3202a
SHA256 8a34536561cfbe3a86c88ef96040db62a93b8a9fc80d28ebb4d44824b1122be3
MD5 55f470e2603340e31a9e0b6278ec2ea6
SHA1 b9a2ed57f3187fff7e954c2079af298ca428769f
SHA512 18bad95a2f247bbb5e5175a192f9be3e607d45b5cfbf6cfda17c73a0367cb905e7d884dd18aaf850729c08da034a59d39596c5d506a29aa72ccad426666eaa57
SSDEEP 6144:h3CpPcS8ZDFHZcEH8gs8Vz2JjC0Ipmp14Be2jAko/+mSDTJqXTTwm3zgukF9BQsB:AcFs8Vz2JjC0Iq+YgoGDDTJkTH8j9B
TLSH
T16384E416E650B0A5F8A348702D79A256792C3D3A3680EC4BB78D9F5A377168370F532F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

19392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar ord588 __vbaStrVarMove __vbaLenBstr __vbaPut3 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 __vbaRaiseEvent __vbaFreeObjList ord516 ord517 _adj_fprem1 __vbaRecAnsiToUni __vbaVarCmpNe __vbaStrCat ord660 __vbaRecDestruct __vbaSetSystemError __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryVar ord666 __vbaVarCmpGe __vbaAryDestruct ord669 __vbaExitProc __vbaVarPow ord593 __vbaVarForInit ord594 __vbaOnError ord595 __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord599 __vbaForEachCollVar ord520 __vbaBoolVar __vbaBoolVarNull __vbaFpR8 _CIsin ord631 __vbaErase ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaCyI2 ord529 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaNextEachCollVar __vbaVarLikeVar __vbaObjVar __vbaI2I4 DllFunctionCall __vbaVarLateMemSt __vbaFpUI1 __vbaCastObjVar __vbaStrR4 __vbaLbound __vbaRedimPreserve _adj_fpatan __vbaR4Var __vbaLateIdCallLd ord676 __vbaR8Cy __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaUI1I2 _CIsqrt __vbaVarAnd __vbaObjIs EVENT_SINK_QueryInterface __vbaStr2Vec __vbaFpCmpCy __vbaUI1I4 __vbaVarMul __vbaExceptHandler ord711 ord712 __vbaStrToUnicode __vbaR4ErrVar _adj_fprem _adj_fdivr_m64 __vbaI2Str ord607 __vbaVarDiv ord714 ord608 __vbaFPException ord717 __vbaInStrVar __vbaGetOwner3 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow ord647 __vbaFileOpen __vbaVar2Vec ord648 ord570 __vbaVarLateMemCallLdRf __vbaNew2 __vbaInStr _adj_fdiv_m32i ord572 _adj_fdivr_m32i ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarNot __vbaVarCmpLt __vbaFreeStrList _adj_fdivr_m32 __vbaR8Var _adj_fdiv_r ord685 ord578 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaFpCy ord610 __vbaLateMemCall __vbaInStrB __vbaAryLock __vbaVarAdd __vbaStrToAnsi ord612 __vbaVarDup __vbaFpI2 __vbaCheckTypeVar ord616 __vbaVarLateMemCallLd __vbaFpI4 __vbaVarCopy __vbaRecDestructAnsi __vbaVarSetObjAddref __vbaLateMemCallLd ord617 __vbaR8IntI2 _CIatan __vbaAryCopy ord618 __vbaCastObj __vbaStrMove __vbaStrVarCopy __vbaR8IntI4 __vbaVarNeg _allmul __vbaVarLateMemCallSt __vbaLateIdSt _CItan __vbaFPInt __vbaAryUnlock __vbaVarForNext _CIexp __vbaRecAssign __vbaI4ErrVar __vbaFreeStr __vbaFreeObj ord581

Sharing