d6ffdd8cc6e4142b3d92a21f2af1b993ac0599b0d1feb07a9ff8a79fa9e425a5

General

Target
d6ffdd8cc6e4142b3d92a21f2af1b993ac0599b0d1feb07a9ff8a79fa9e425a5
Size 176KB
Sample260708-pg389sgv2m
SHA256 d6ffdd8cc6e4142b3d92a21f2af1b993ac0599b0d1feb07a9ff8a79fa9e425a5
MD5 4473888e333417eee90f70eb2dd1dbd3
SHA1 4ccbd3a9c36125531f38730cb4861a0d751e1ff8
SHA512 46bacbac78cafb02fe64f754664712335afe20a0ee545c87d3582b141726b3ec21d6ed72c7d97155bc95eb6b2263fe1e7a6d6b216ae3bb7c21a50781c1b3be75
SSDEEP 3072:XXD0ZwgC2cEo5snCleQxQ1P0J4afCRuYWigMyJXPKMY0F:XXPKCljq1PAKRuYWigMs
TLSH
T1BE04E72FBA001111E252457328656BB716E33C26D551FC0B628DBE492FF3AB7ADB131B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6ffdd8cc6e4142b3d92a21f2af1b993ac0599b0d1feb07a9ff8a79fa9e425a5

File Explorer

d6ffdd8cc6e4142b3d92a21f2af1b993ac0599b0d1feb07a9ff8a79fa9e425a5

.exe 176KB

d6ffdd8cc6e4142b3d92a21f2af1b993ac0599b0d1feb07a9ff8a79fa9e425a5

IMPHASH de65b86e61564d4cf5fda4b42d85e87b
SHA256 d6ffdd8cc6e4142b3d92a21f2af1b993ac0599b0d1feb07a9ff8a79fa9e425a5
MD5 4473888e333417eee90f70eb2dd1dbd3
SHA1 4ccbd3a9c36125531f38730cb4861a0d751e1ff8
SHA512 46bacbac78cafb02fe64f754664712335afe20a0ee545c87d3582b141726b3ec21d6ed72c7d97155bc95eb6b2263fe1e7a6d6b216ae3bb7c21a50781c1b3be75
SSDEEP 3072:XXD0ZwgC2cEo5snCleQxQ1P0J4afCRuYWigMyJXPKMY0F:XXPKCljq1PAKRuYWigMs
TLSH
T1BE04E72FBA001111E252457328656BB716E33C26D551FC0B628DBE492FF3AB7ADB131B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarTstGt __vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaFreeVar __vbaLineInputStr __vbaLenBstr __vbaStrVarMove __vbaEnd __vbaFreeVarList _adj_fdiv_m64 EVENT_SINK_Invoke __vbaRaiseEvent __vbaFreeObjList _adj_fprem1 ord518 __vbaRecAnsiToUni ord519 __vbaI2Abs __vbaCopyBytes __vbaStrCat __vbaLsetFixstr __vbaRecDestruct __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaVarTstLe __vbaAryVar ord666 Zombie_GetTypeInfo __vbaAryDestruct __vbaForEachCollObj __vbaExitProc ord595 __vbaOnError __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaFpR4 __vbaStrFixstr ord520 __vbaFpR8 _CIsin __vbaErase __vbaLateMemStAd __vbaNextEachCollObj __vbaVarCmpGt __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp ord529 __vbaAryConstruct2 __vbaVarTstEq __vbaI2I4 DllFunctionCall _adj_fpatan __vbaFixstrConstruct __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaStrR8 __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler ord711 ord712 __vbaStrToUnicode __vbaPrintFile ord606 _adj_fprem _adj_fdivr_m64 ord608 ord531 __vbaFPException ord717 __vbaInStrVar ord319 __vbaStrVarVal __vbaUbound __vbaVarCat __vbaCheckType __vbaI2Var __vbaLsetFixstrFree ord644 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaInStr __vbaNew2 __vbaR8Str ord571 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaI4Str ord681 __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaVarTstNe __vbaI4Var __vbaVarAdd __vbaAryLock ord320 __vbaStrToAnsi __vbaVarDup ord321 ord614 __vbaFpI2 __vbaVarCopy ord616 __vbaFpI4 __vbaR8IntI2 __vbaRecDestructAnsi ord617 _CIatan __vbaCastObj __vbaAryCopy __vbaStrMove ord619 __vbaStrVarCopy ord650 _allmul __vbaLateIdSt _CItan __vbaAryUnlock _CIexp __vbaFreeObj __vbaRecAssign __vbaFreeStr ord581

Sharing

General

Malware Config

Signatures

File Explorer

d6ffdd8cc6e4142b3d92a21f2af1b993ac0599b0d1feb07a9ff8a79fa9e425a5

msvbvm60

generic