cf299b8f984480e574240059cba6fe86b8dcc3ada66b17c62f58392c9324abb5

General

Target
cf299b8f984480e574240059cba6fe86b8dcc3ada66b17c62f58392c9324abb5
Size 1.4MB
Sample260811-e6a9nswbnf
SHA256 cf299b8f984480e574240059cba6fe86b8dcc3ada66b17c62f58392c9324abb5
MD5 40d9e11f46961d8b1287ed0dd64401fc
SHA1 5350023d98edef4a1d6160a5ec107c4f176700ef
SHA512 643ba0efcee59de5d406d9e0d7c87ca817bf9a896e3cdc191cc3c000c8d54e265db0730ef70ea825ddc843bfd8e039df7eafa0bb051284fa84780e8ceaa7d4b9
SSDEEP 24576:0kYZn9o37o0T9lKK/DpQRy9O4E2HSx0blnxyvdu1mdu3FfP6Bft08ky0Pbmpx0nP:Un9cQYEQggJSofEgSsj8Rt1K
TLSH
T1AE659213B661462FF1C58438635BE2A665192E37260DD16FF3809F6C2136AE2F77A703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf299b8f984480e574240059cba6fe86b8dcc3ada66b17c62f58392c9324abb5

File Explorer

cf299b8f984480e574240059cba6fe86b8dcc3ada66b17c62f58392c9324abb5

.dll 1.4MB

cf299b8f984480e574240059cba6fe86b8dcc3ada66b17c62f58392c9324abb5

IMPHASH 2689a165a94cd884e8a59b3c8881881f
SHA256 cf299b8f984480e574240059cba6fe86b8dcc3ada66b17c62f58392c9324abb5
MD5 40d9e11f46961d8b1287ed0dd64401fc
SHA1 5350023d98edef4a1d6160a5ec107c4f176700ef
SHA512 643ba0efcee59de5d406d9e0d7c87ca817bf9a896e3cdc191cc3c000c8d54e265db0730ef70ea825ddc843bfd8e039df7eafa0bb051284fa84780e8ceaa7d4b9
SSDEEP 24576:0kYZn9o37o0T9lKK/DpQRy9O4E2HSx0blnxyvdu1mdu3FfP6Bft08ky0Pbmpx0nP:Un9cQYEQggJSofEgSsj8Rt1K
TLSH
T1AE659213B661462FF1C58438635BE2A665192E37260DD16FF3809F6C2136AE2F77A703
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvbvm60

ord582 ord583 __vbaStrI2 ord584 _CIcos _adj_fptan __vbaVarMove ord585 __vbaStrI4 __vbaVarVargNofree __vbaFreeVar __vbaAptOffset __vbaLenBstr __vbaStrVarMove __vbaFreeVarList _adj_fdiv_m64 __vbaFreeObjList _adj_fprem1 ord519 __vbaCopyBytes __vbaStrCat __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct __vbaLateMemSt __vbaExitProc ord595 __vbaOnError __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaFpR4 ord520 __vbaBoolVar __vbaFPFix __vbaBoolVarNull __vbaFpR8 _CIsin ord631 ord525 __vbaChkstk EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaStrCmp __vbaVarTstEq __vbaAryConstruct2 __vbaObjVar __vbaI2I4 ord561 __vbaVarLateMemSt __vbaRedimPreserve _adj_fpatan __vbaRedim __vbaStrR8 EVENT_SINK_Release __vbaNew _CIsqrt __vbaVarAnd EVENT_SINK_QueryInterface __vbaVarMul __vbaExceptHandler ord711 ord712 _adj_fprem _adj_fdivr_m64 __vbaVarDiv ord607 __vbaI2Str __vbaFPException __vbaStrCompVar __vbaStrVarVal __vbaUbound __vbaVarCat __vbaI2Var _CIlog __vbaErrorOverflow __vbaInStr __vbaVarLateMemCallLdRf __vbaR8Str __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaI4Str ord681 __vbaFreeStrList _adj_fdivr_m32 __vbaPowerR8 __vbaR8Var _adj_fdiv_r __vbaVarTstNe ord101 ord102 __vbaI4Var ord103 __vbaVarCmpEq ord104 ord105 __vbaVarAdd __vbaLateMemCall __vbaAryLock __vbaStrComp __vbaVarDup ord614 __vbaVarCopy __vbaFpI4 __vbaVarLateMemCallLd __vbaLateMemCallLd _CIatan ord618 __vbaAryCopy __vbaStrMove __vbaCastObj __vbaR8IntI4 _allmul _CItan __vbaFPInt __vbaAryUnlock _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing

General

Malware Config

Signatures

File Explorer

cf299b8f984480e574240059cba6fe86b8dcc3ada66b17c62f58392c9324abb5

msvbvm60

generic