SKS[.]zip | Triage™

General

Target
SKS.zip
Size 498KB
Sample261107-vbvylazwcx
SHA256 ea0e2406a1328b401ed36f47a7b4c93631c29b4bbda167e39f89e3a9c1ebf34f
MD5 55c85903aeb833d85f0c27cfe398e6cd
SHA1 efc2f5fcb1f44dda83e4bee2f1ade592fae28db1
SHA512 048817d3abd70e4cef6a8b8c67b6e655e00c66a42fffb4ac2e226bbeab56ce30cb9e5a2a285b6931ce798fb4c07ee71f305cae649bd12430c74fb68711bf13b4
SSDEEP 12288:9kaWOPQJwhk8PwN7XHcTZNZQJG81oLRgYlNZstq+DFUMn+:WaW8jDCMd189YlNZkRUw+
TLSH
T1BDB42363C281AE67EDC69373360EDD315B35B259C7982832447A6EC230FA9471F641D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SKS.exe

File Explorer

SKS.zip

.zip 498KB
Orders.mdb

4.4MB
SKS.exe

.exe 824KB

SKS.zip

SHA256 ea0e2406a1328b401ed36f47a7b4c93631c29b4bbda167e39f89e3a9c1ebf34f
MD5 55c85903aeb833d85f0c27cfe398e6cd
SHA1 efc2f5fcb1f44dda83e4bee2f1ade592fae28db1
SHA512 048817d3abd70e4cef6a8b8c67b6e655e00c66a42fffb4ac2e226bbeab56ce30cb9e5a2a285b6931ce798fb4c07ee71f305cae649bd12430c74fb68711bf13b4
SSDEEP 12288:9kaWOPQJwhk8PwN7XHcTZNZQJG81oLRgYlNZstq+DFUMn+:WaW8jDCMd189YlNZkRUw+
TLSH
T1BDB42363C281AE67EDC69373360EDD315B35B259C7982832447A6EC230FA9471F641D7
MD5 SHA1 SHA512 SSDEEP TLSH

SKS.exe

IMPHASH 3cdbf18dbdcc7cfbad54bc866810bd1f
SHA256 e8644ba746ed61a55c944a140cb9e6f862561a53874502e6089553c2112ab281
MD5 a8350675f79eb342d4c05aef7e61bd16
SHA1 c80cb764d689d3ee282a46eeffcd84f34a482dc1
SHA512 c0f566f526095995b05daa766e9b78e948d4904fd0da1b4a8da36aef870aa9ee579855d57c84315ff61c28e66eca81449d11f0a7b1a9e36348841718c7ebb63d
SSDEEP 12288:ytveuzeS7AF2x+9yBHJmDn/DwKxPMHBPMHY5Cc4EhAnAZ1vW0K:934+9y5JY/DwKQgYYcFh6AZ1/K
TLSH
T175052A135A484040E851CC3214251A6F597B7EADA81CFF3FAA45BD5A6A337CF3CEC25A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8644

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaFreeVar __vbaLateIdCall __vbaLenBstr __vbaStrVarMove __vbaEnd __vbaFreeVarList _adj_fdiv_m64 __vbaFpCDblR8 __vbaFreeObjList ord516 __vbaStrErrVarCopy _adj_fprem1 __vbaVarCmpNe __vbaStrCat ord660 __vbaHresultCheckObj ord558 _adj_fdiv_m32 __vbaExitProc ord300 __vbaOnError ord595 __vbaObjSet _adj_fdiv_m16i ord303 __vbaObjSetAddref _adj_fdivr_m16i ord598 ord306 __vbaForEachCollVar __vbaBoolVar ord520 ord309 __vbaBoolVarNull _CIsin __vbaChkstk EVENT_SINK_AddRef ord528 __vbaStrCmp __vbaVarTstEq __vbaNextEachCollVar __vbaI2I4 ord561 __vbaVarOr __vbaCastObjVar _adj_fpatan __vbaR4Var __vbaLateIdCallLd __vbaStrR8 EVENT_SINK_Release __vbaNew _CIsqrt __vbaLateIdCallSt __vbaObjIs EVENT_SINK_QueryInterface __vbaExceptHandler _adj_fprem _adj_fdivr_m64 __vbaI2Str __vbaLateIdStAd ord608 __vbaFPException __vbaStrVarVal ord534 __vbaVarCat __vbaI2Var ord537 _CIlog __vbaErrorOverflow __vbaR8Str __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaVarNot __vbaFreeStrList _adj_fdivr_m32 __vbaR8Var _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var __vbaVarCmpEq ord610 __vbaVarAdd __vbaVarDup __vbaVerifyVarObj _CIatan __vbaCastObj ord540 __vbaStrMove ord619 ord541 _allmul __vbaLateIdSt _CItan ord546 _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing