d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b

General

Target
d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b
Size 1.8MB
Sample260811-e6grfs1xdw
SHA256 d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b
MD5 50fe3c36de45def3b76d232d2243bea0
SHA1 cd8678b2818de1fd3e13c679ca1b569db7a792c2
SHA512 87dba4f7618cbd8066cf0e22b1dbbcc9d79ff862505e896958400a4b881c40082110976f7d3fd83cee5a2e356b5c813d418e38d4b2c38401ff9ed09b276c7553
SSDEEP 49152:w8+kk/7zCCr0x+7/wx421/DPwdhDy1O0MmMFBpm:w8+ke7zS+7ox421/Dwdh+1O0MmMFBp
TLSH
T12395A51AF762601DF4C2807C6356B397A5542E361A08C46FF7C09F5C25BDAEBA2B8707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b

File Explorer

d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b

.dll 1.8MB

d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b

IMPHASH 32c6f0c6e2793e392f8d23564189f998
SHA256 d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b
MD5 50fe3c36de45def3b76d232d2243bea0
SHA1 cd8678b2818de1fd3e13c679ca1b569db7a792c2
SHA512 87dba4f7618cbd8066cf0e22b1dbbcc9d79ff862505e896958400a4b881c40082110976f7d3fd83cee5a2e356b5c813d418e38d4b2c38401ff9ed09b276c7553
SSDEEP 49152:w8+kk/7zCCr0x+7/wx421/DPwdhDy1O0MmMFBpm:w8+ke7zS+7ox421/Dwdh+1O0MmMFBp
TLSH
T12395A51AF762601DF4C2807C6356B397A5542E361A08C46FF7C09F5C25BDAEBA2B8707
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

16500

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvbvm60

ord582 __vbaVarSub __vbaVarTstGt ord583 __vbaStrI2 _CIcos _adj_fptan ord585 __vbaStrI4 __vbaVarMove __vbaVarVargNofree ord587 __vbaFpCDblR4 __vbaFreeVar __vbaAptOffset __vbaLineInputStr __vbaStrVarMove __vbaLenBstr __vbaFreeVarList _adj_fdiv_m64 __vbaVarIndexStore __vbaNextEachVar __vbaFreeObjList __vbaStrErrVarCopy __vbaVarIndexLoadRef _adj_fprem1 __vbaCVarAryUdt ord519 __vbaCopyBytes __vbaStrCat __vbaLsetFixstr ord660 __vbaSetSystemError __vbaStrDate __vbaRecDestruct __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryVar __vbaVarTstLe __vbaAryDestruct __vbaVarCmpGe __vbaLateMemSt ord592 __vbaStrBool __vbaVarPow __vbaBoolStr __vbaExitProc ord595 __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad __vbaFpR4 __vbaBoolVar __vbaStrFixstr ord520 __vbaFpR8 __vbaVarTstLt __vbaBoolVarNull _CIsin __vbaErase ord631 ord524 __vbaVarCmpGt ord525 __vbaVarZero ord632 __vbaVargVarMove __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef __vbaVarAbs ord528 __vbaGenerateBoundsError ord529 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaDateR8 __vbaR4Str __vbaI2I4 ord561 __vbaObjVar DllFunctionCall __vbaVarOr __vbaVarLateMemSt __vbaRedimPreserve __vbaStrR4 _adj_fpatan __vbaR4Var __vbaLateIdCallLd __vbaStrR8 __vbaRedim EVENT_SINK_Release __vbaNew ord601 _CIsqrt __vbaVarAnd EVENT_SINK_QueryInterface __vbaVarMul __vbaExceptHandler ord711 __vbaStrToUnicode __vbaR4ErrVar _adj_fprem _adj_fdivr_m64 ord607 __vbaR8ErrVar __vbaI2Str __vbaVarDiv ord608 __vbaVarCmpLe __vbaFPException __vbaStrCompVar __vbaUbound __vbaStrVarVal __vbaVarCat __vbaLsetFixstrFree __vbaI2Var __vbaExitEachVar _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaR8Str __vbaNew2 ord648 __vbaInStr ord571 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaI4Str ord681 __vbaVarNot __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 __vbaR8Var _adj_fdiv_r __vbaVarTstNe ord101 ord102 __vbaI4Var ord103 __vbaVarCmpEq ord104 ord105 __vbaAryLock __vbaVarAdd __vbaLateMemCall __vbaStrComp __vbaStrToAnsi __vbaVarDup __vbaFpI2 ord614 ord616 __vbaVarTstGe __vbaFpI4 __vbaVarLateMemCallLd __vbaR8IntI2 ord617 __vbaLateMemCallLd _CIatan __vbaAryCopy __vbaCastObj __vbaI2ErrVar __vbaStrMove __vbaForEachVar ord619 __vbaR8IntI4 __vbaVarNeg _allmul __vbaVarLateMemCallSt _CItan __vbaAryUnlock __vbaFPInt __vbaFpCSngR8 _CIexp __vbaRecAssign __vbaI4ErrVar __vbaFreeObj __vbaFreeStr ord581

Sharing

General

Malware Config

Signatures

File Explorer

d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b

msvbvm60

generic