b619db338a081fd48c2980a234040474ffddfbbb7d159d264bf286d622503e6e

General

Target
b619db338a081fd48c2980a234040474ffddfbbb7d159d264bf286d622503e6e
Size 232KB
Sample260828-rt43faar4x
SHA256 b619db338a081fd48c2980a234040474ffddfbbb7d159d264bf286d622503e6e
MD5 4d60be6eed7f9bd0e3a5e059f36a1eb2
SHA1 c6702139fac3b7f942b5ba260f5e76148970d6dd
SHA512 7531ba02670682e2c5fec2408d2c63945d55d3ce36ff8e091347e9a15b867b5d7ac93a7e5cc53df1306dc3a5e68ef3c846eb7796c44051928996892641adfad3
SSDEEP 3072:c1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1Vne1i/NU82OMYcYU:Ki/NjO5xbg/CSUFLTwMjs6wi/N+O7
TLSH
T1AA340839F655A06CF28305702E31B627A626BD305951E80EFB05AB1968B83C7F5F4F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b619db338a081fd48c2980a234040474ffddfbbb7d159d264bf286d622503e6e

File Explorer

b619db338a081fd48c2980a234040474ffddfbbb7d159d264bf286d622503e6e

.exe 232KB

b619db338a081fd48c2980a234040474ffddfbbb7d159d264bf286d622503e6e

IMPHASH 1a9fb32cefd2d95c73769ee8a5de8d81
SHA256 b619db338a081fd48c2980a234040474ffddfbbb7d159d264bf286d622503e6e
MD5 4d60be6eed7f9bd0e3a5e059f36a1eb2
SHA1 c6702139fac3b7f942b5ba260f5e76148970d6dd
SHA512 7531ba02670682e2c5fec2408d2c63945d55d3ce36ff8e091347e9a15b867b5d7ac93a7e5cc53df1306dc3a5e68ef3c846eb7796c44051928996892641adfad3
SSDEEP 3072:c1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1Vne1i/NU82OMYcYU:Ki/NjO5xbg/CSUFLTwMjs6wi/N+O7
TLSH
T1AA340839F655A06CF28305702E31B627A626BD305951E80EFB05AB1968B83C7F5F4F27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5796

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

_CIcos _adj_fptan __vbaVarMove __vbaFreeVar __vbaStrVarMove __vbaEnd __vbaFreeVarList _adj_fdiv_m64 __vbaPut4 __vbaFreeObjList _adj_fprem1 __vbaRecAnsiToUni __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaHresultCheckObj __vbaNameFile _adj_fdiv_m32 __vbaAryDestruct ord593 ord594 __vbaOnError __vbaObjSet _adj_fdiv_m16i _adj_fdivr_m16i __vbaStrFixstr __vbaBoolVarNull _CIsin __vbaChkstk __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp __vbaAryConstruct2 __vbaGet4 __vbaObjVar DllFunctionCall __vbaVarLateMemSt _adj_fpatan __vbaRecUniToAnsi EVENT_SINK_Release ord600 _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler _adj_fprem _adj_fdivr_m64 ord608 ord716 __vbaFPException __vbaStrVarVal __vbaVarCat __vbaI2Var ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaInStr __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy ord681 __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaVarSetVar __vbaI4Var __vbaVarAdd __vbaLateMemCall __vbaVarDup __vbaStrToAnsi ord616 __vbaVarLateMemCallLd __vbaVarCopy _CIatan __vbaStrMove _allmul _CItan __vbaFPInt _CIexp __vbaFreeStr __vbaFreeObj

Sharing

General

Malware Config

Signatures

File Explorer

b619db338a081fd48c2980a234040474ffddfbbb7d159d264bf286d622503e6e

msvbvm60

generic