daisymaker[.]lzh | Triage™

General

Target
daisymaker.lzh
Size 21KB
Sample260718-pfj41abs5l
SHA256 c1571272ca8a1155325c59d91fe1ecbb188fe972675ff025cbda2ba6a526e920
MD5 740bc7b0d6be0fda2595c1d1c18ec3c3
SHA1 e840359d14b0eaeae72f5b6c9c94d2598f191c7d
SHA512 5c27a940643bb89a64d8e279e91670d0463f955cddd42cd3ac2e474eb829f8c413b7d624c094b5844db02d526872c3d59692fb5984ace3170c5d8ec1ed3ce0ae
SSDEEP 384:6d1GkRcntEAA9liMEXK0bAjgOSRCflLdSz6J1eaMrdSjFaFBWqin96Twu8KIbeoR:+1GCeMEXKIAjx9tLdSzOMrd6FaFM1n93
TLSH
T104A2D0D96174BADC255C9EF7D013E73D8ABE747060A4CB0A9E0C93F2CB64DA1C930A56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DaisyMaker.exe

File Explorer

daisymaker.lzh

.lzh 21KB
DaisyMaker.exe

.exe 50KB
readme.txt

834B

daisymaker.lzh

SHA256 c1571272ca8a1155325c59d91fe1ecbb188fe972675ff025cbda2ba6a526e920
MD5 740bc7b0d6be0fda2595c1d1c18ec3c3
SHA1 e840359d14b0eaeae72f5b6c9c94d2598f191c7d
SHA512 5c27a940643bb89a64d8e279e91670d0463f955cddd42cd3ac2e474eb829f8c413b7d624c094b5844db02d526872c3d59692fb5984ace3170c5d8ec1ed3ce0ae
SSDEEP 384:6d1GkRcntEAA9liMEXK0bAjgOSRCflLdSz6J1eaMrdSjFaFBWqin96Twu8KIbeoR:+1GCeMEXKIAjx9tLdSzOMrd6FaFM1n93
TLSH
T104A2D0D96174BADC255C9EF7D013E73D8ABE747060A4CB0A9E0C93F2CB64DA1C930A56
MD5 SHA1 SHA512 SSDEEP TLSH

DaisyMaker.exe

IMPHASH 8e90129ce690f8ae99f756fe6c1bf311
SHA256 02ac4c0d8bd57362db1e0d39d2a383150a10be9ee784ede44eea93bb2aaccaec
MD5 0d51202724447fba40a7935eb27ba4c8
SHA1 d8a76f29e227f85ee4098fc71d937f513a136002
SHA512 8dec243609f74be1fba236491a4e186e39f70d0d8352c363dad2b6c226b5d3f2f13e55bab75cd7d662576d211ce27dc1f5cc31eb0eec6feee9162fbfe4ee81b9
SSDEEP 1536:vHmJNrYf8sjv+tlT3gy24HGu3RgVIYkl4d:vHmP2MT3rl4
TLSH
T1D3331613E61C5431FA5982F60D352AEA5C7BFC3538015A47A248AF8DFE396C4E91631F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

ShellExecuteA

msvbvm50

ord582 __vbaVarSub ord583 __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaFreeVarList __vbaEnd _adj_fdiv_m64 __vbaFreeObjList _adj_fprem1 __vbaRecAnsiToUni __vbaStrCat ord660 __vbaSetSystemError __vbaRecDestruct __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryDestruct __vbaLateMemSt ord593 __vbaForEachCollObj ord594 __vbaI4Abs __vbaOnError __vbaObjSet ord595 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 ord520 _CIsin __vbaErase __vbaNextEachCollObj ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp __vbaObjVar ord561 DllFunctionCall __vbaAryConstruct __vbaRedimPreserve _adj_fpatan __vbaLateIdCallLd __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler __vbaPrintFile __vbaInputFile ord606 _adj_fprem _adj_fdivr_m64 __vbaFPException ord319 __vbaStrVarVal __vbaVarCat __vbaCheckType ord537 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaNew2 __vbaInStr ord571 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaI4Var ord610 __vbaAryLock ord320 ord612 __vbaVarDup __vbaStrToAnsi ord321 __vbaFpI4 ord616 __vbaLateMemCallLd __vbaRecDestructAnsi _CIatan __vbaStrMove __vbaCastObj _allmul _CItan __vbaFPInt __vbaAryUnlock _CIexp __vbaFreeObj __vbaFreeStr ord581

Sharing