GeminiSC[.]exe | Triage™

General

Target
GeminiSC.exe
Size 384KB
Sample260803-pdasjsxbph
SHA256 cbc71fc8fe9d68d383de8d58992670b2e1836a4502ba20b39e2a5edfcb82efe3
MD5 0855fec4dfc261bd74a15a38a3f659fc
SHA1 426680c6ed3e1368320903bfb11771d1b85b23be
SHA512 2cbaee60122d020acabc588b3f2451b4fd4b4de956bc77b525537fb862dc107a001f9379143c65b9cdf484aae7e68609276c51a0969829c60e5f7593fb67aa1d
SSDEEP 6144:LOWGSwTDWI3Ko56nZ1t/Buw/55/dJk/h/8/2/rZJ+tZe2HmgLM481I1R7+QQ:KSwTDT5qowB58p0+zZJ+ve2zLk1CR7W
TLSH
T15584D513AF51A242F56205B0382CA69A5D353C766052EC0BFBC2AF5D2471AE7F8F531B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GeminiSC.exe

File Explorer

GeminiSC.exe

.exe 384KB

GeminiSC.exe

IMPHASH 53d4d5b0969d05df9451ebc57273ea42
SHA256 cbc71fc8fe9d68d383de8d58992670b2e1836a4502ba20b39e2a5edfcb82efe3
MD5 0855fec4dfc261bd74a15a38a3f659fc
SHA1 426680c6ed3e1368320903bfb11771d1b85b23be
SHA512 2cbaee60122d020acabc588b3f2451b4fd4b4de956bc77b525537fb862dc107a001f9379143c65b9cdf484aae7e68609276c51a0969829c60e5f7593fb67aa1d
SSDEEP 6144:LOWGSwTDWI3Ko56nZ1t/Buw/55/dJk/h/8/2/rZJ+tZe2HmgLM481I1R7+QQ:KSwTDT5qowB58p0+zZJ+ve2zLk1CR7W
TLSH
T15584D513AF51A242F56205B0382CA69A5D353C766052EC0BFBC2AF5D2471AE7F8F531B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaVarTstGt __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaVarVargNofree __vbaFreeVar __vbaLineInputStr __vbaStrVarMove __vbaLenBstr __vbaFreeVarList __vbaEnd _adj_fdiv_m64 __vbaVarIndexStore __vbaLineInputVar __vbaFreeObjList ord516 _adj_fprem1 __vbaVarCmpNe __vbaStrCat ord660 __vbaSetSystemError __vbaNameFile __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaVarCmpGe __vbaExitProc __vbaVarForInit ord300 ord595 __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord306 __vbaBoolVar ord520 ord521 ord523 __vbaFpR8 __vbaVarTstLt __vbaBoolVarNull _CIsin ord631 __vbaVarCmpGt ord632 __vbaChkstk __vbaFileClose EVENT_SINK_AddRef ord528 __vbaVarAbs __vbaGenerateBoundsError ord529 __vbaStrCmp __vbaVarTstEq __vbaI2I4 DllFunctionCall ord670 __vbaVarOr __vbaCastObjVar __vbaRedimPreserve _adj_fpatan __vbaR4Var __vbaLateIdCallLd __vbaStrR8 __vbaRedim EVENT_SINK_Release ord600 _CIsqrt __vbaRedimVar __vbaVarAnd EVENT_SINK_QueryInterface __vbaVarMul __vbaExceptHandler __vbaStrToUnicode __vbaPrintFile ord606 _adj_fprem _adj_fdivr_m64 ord714 __vbaVarDiv ord530 ord716 ord531 __vbaVarCmpLe __vbaFPException __vbaInStrVar __vbaUbound __vbaStrVarVal ord535 __vbaI2Var ord537 ord645 _CIlog __vbaErrorOverflow ord647 __vbaFileOpen __vbaR8Str ord648 __vbaNew2 __vbaInStr ord571 __vbaVarInt _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy ord681 __vbaVarCmpLt __vbaFreeStrList _adj_fdivr_m32 __vbaR8Var _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var __vbaVarCmpEq __vbaAryLock __vbaVarAdd __vbaStrToAnsi __vbaVarDup ord612 ord613 __vbaFpI2 __vbaVarMod ord616 __vbaVarCopy __vbaVarTstGe ord617 _CIatan __vbaCastObj __vbaStrMove __vbaMidStmtVar __vbaStrVarCopy ord650 _allmul __vbaLateIdSt _CItan __vbaFPInt __vbaAryUnlock __vbaVarForNext _CIexp __vbaMidStmtBstr __vbaFreeStr __vbaFreeObj ord581

Sharing