b260048cbbd6674d3e401fbeafeeca8d5d7d6261c45eb26437016ab7933eb2e3

General

Target
b260048cbbd6674d3e401fbeafeeca8d5d7d6261c45eb26437016ab7933eb2e3
Size 232KB
Sample260826-wbrrlstcnf
SHA256 b260048cbbd6674d3e401fbeafeeca8d5d7d6261c45eb26437016ab7933eb2e3
MD5 3e851d88e1a8ef7aa607075eba280753
SHA1 02ce2fb6aa562c01502b97acca5c6de322147d9f
SHA512 a1f5e871b1fffed1146c0755d1ca78293b99c8f8dc49d9ead239d227e5c9f9c10f6fadf0d775390233b554595f8e263f5e9e5d7332f602e4aa03f66aebfb5517
SSDEEP 3072:9I1i/NU8bOMYcYYcmy5cU+gTn6HOjDhWrzvvQwlgO5s1i/NU82OMYcYYamv5b:Qi/NjO5YBgegD0PHzSni/N+O7
TLSH
T14E341836F655A02CF29315342E31B626B626BD305941EC0EFB496B1868B87C7F0F4B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b260048cbbd6674d3e401fbeafeeca8d5d7d6261c45eb26437016ab7933eb2e3

File Explorer

b260048cbbd6674d3e401fbeafeeca8d5d7d6261c45eb26437016ab7933eb2e3

.exe 232KB

b260048cbbd6674d3e401fbeafeeca8d5d7d6261c45eb26437016ab7933eb2e3

IMPHASH 29e2761e4f49f3db082f068d77ac72d2
SHA256 b260048cbbd6674d3e401fbeafeeca8d5d7d6261c45eb26437016ab7933eb2e3
MD5 3e851d88e1a8ef7aa607075eba280753
SHA1 02ce2fb6aa562c01502b97acca5c6de322147d9f
SHA512 a1f5e871b1fffed1146c0755d1ca78293b99c8f8dc49d9ead239d227e5c9f9c10f6fadf0d775390233b554595f8e263f5e9e5d7332f602e4aa03f66aebfb5517
SSDEEP 3072:9I1i/NU8bOMYcYYcmy5cU+gTn6HOjDhWrzvvQwlgO5s1i/NU82OMYcYYamv5b:Qi/NjO5YBgegD0PHzSni/N+O7
TLSH
T14E341836F655A02CF29315342E31B626B626BD305941EC0EFB496B1868B87C7F0F4B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

_CIcos _adj_fptan __vbaVarMove __vbaFreeVar __vbaStrVarMove __vbaFreeVarList __vbaEnd _adj_fdiv_m64 __vbaPut4 __vbaFreeObjList _adj_fprem1 __vbaRecAnsiToUni __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaHresultCheckObj __vbaNameFile _adj_fdiv_m32 __vbaAryDestruct ord593 ord594 __vbaOnError __vbaObjSet _adj_fdiv_m16i _adj_fdivr_m16i __vbaStrFixstr __vbaBoolVarNull _CIsin __vbaChkstk __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp __vbaGet4 __vbaAryConstruct2 __vbaObjVar DllFunctionCall __vbaVarLateMemSt _adj_fpatan __vbaRecUniToAnsi EVENT_SINK_Release ord600 _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler _adj_fprem _adj_fdivr_m64 ord608 ord716 __vbaFPException __vbaStrVarVal __vbaVarCat __vbaI2Var ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaInStr __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy ord681 __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaVarSetVar __vbaI4Var __vbaVarAdd __vbaLateMemCall __vbaVarDup __vbaStrToAnsi ord616 __vbaVarLateMemCallLd __vbaVarCopy _CIatan __vbaStrMove _allmul _CItan __vbaFPInt _CIexp __vbaFreeStr __vbaFreeObj

Sharing

General

Malware Config

Signatures

File Explorer

b260048cbbd6674d3e401fbeafeeca8d5d7d6261c45eb26437016ab7933eb2e3

msvbvm60

generic