abacus[.]exe | Triage™

General

Target
abacus.exe
Size 568KB
Sample260420-g5ralsbs7m
SHA256 d613eef058e33aa2be3d058e47b2d493a7dcd1a503a9393aa2890feb858f73c8
MD5 92f7f74d6b3cf8cbf1dfa145348c631b
SHA1 049a4bc863ebcaf2178acf391ac0fee1696730c2
SHA512 e81e6b1c35e14fc90df5a9b5945527741df9991753c8392e127148e35c0387f4806e316ceb222ffabba296ccacaaba8ba55c89226666e472e0dcd0db52554bbc
SSDEEP 12288:v4eo6+WjBnLUzbVOYVvfhodhFuN24M+/rjNJi:w0+mavfSV4M+/V
TLSH
T1A7C42F16EA21A42FF453CDB0697996467C2D2D321690EC5BF7801BA930B49ABF1F071F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
abacus.exe

File Explorer

abacus.exe

.exe 568KB

abacus.exe

IMPHASH 80c546a8b2b339eb138f820fdf5765f8
SHA256 d613eef058e33aa2be3d058e47b2d493a7dcd1a503a9393aa2890feb858f73c8
MD5 92f7f74d6b3cf8cbf1dfa145348c631b
SHA1 049a4bc863ebcaf2178acf391ac0fee1696730c2
SHA512 e81e6b1c35e14fc90df5a9b5945527741df9991753c8392e127148e35c0387f4806e316ceb222ffabba296ccacaaba8ba55c89226666e472e0dcd0db52554bbc
SSDEEP 12288:v4eo6+WjBnLUzbVOYVvfhodhFuN24M+/rjNJi:w0+mavfSV4M+/V
TLSH
T1A7C42F16EA21A42FF453CDB0697996467C2D2D321690EC5BF7801BA930B49ABF1F071F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

42060

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaFreeVar __vbaAryMove __vbaLenBstr __vbaStrVarMove __vbaEnd __vbaFreeVarList _adj_fdiv_m64 ord516 _adj_fprem1 __vbaRecAnsiToUni __vbaStrCat __vbaVarCmpNe ord660 __vbaSetSystemError __vbaRecDestruct __vbaLenVar _adj_fdiv_m32 ord666 __vbaVarCmpGe __vbaAryDestruct __vbaExitProc __vbaVarForInit ord593 __vbaVarPow ord594 __vbaOnError _adj_fdiv_m16i _adj_fdivr_m16i ord598 ord520 __vbaFpR8 __vbaBoolVarNull _CIsin ord631 ord632 __vbaChkstk __vbaFileClose __vbaGenerateBoundsError __vbaStrCmp __vbaCyI2 ord529 __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaI2I4 DllFunctionCall __vbaRedimPreserve __vbaLbound _adj_fpatan __vbaR4Var ord676 __vbaR8Cy __vbaRedim __vbaRecUniToAnsi __vbaUI1I2 _CIsqrt __vbaVarAnd __vbaStr2Vec __vbaVarMul __vbaFpCmpCy __vbaUI1I4 __vbaExceptHandler __vbaStrToUnicode ord712 _adj_fprem _adj_fdivr_m64 __vbaI2Str __vbaVarDiv ord607 ord714 ord608 __vbaFPException __vbaInStrVar ord717 __vbaGetOwner3 __vbaStrVarVal __vbaUbound __vbaVarCat ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord570 __vbaInStr ord648 __vbaVar2Vec _adj_fdiv_m32i ord572 _adj_fdivr_m32i __vbaStrCopy ord573 ord681 __vbaI4Str __vbaFreeStrList __vbaVarCmpLt _adj_fdivr_m32 __vbaR8Var _adj_fdiv_r ord100 __vbaVarTstNe __vbaI4Var __vbaFpCy __vbaAryLock __vbaInStrB __vbaVarAdd __vbaStrToAnsi __vbaVarDup __vbaFpI2 __vbaFpI4 __vbaVarCopy __vbaRecDestructAnsi __vbaR8IntI2 ord617 _CIatan __vbaStrMove __vbaAryCopy __vbaStrVarCopy __vbaR8IntI4 __vbaVarNeg _allmul _CItan __vbaAryUnlock __vbaFPInt __vbaVarForNext _CIexp __vbaI4ErrVar __vbaFreeStr __vbaFreeObj ord581

Sharing