fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201

Sharing

Copy URL Twitter E-mail

General

Target
fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201
Size 1.0MB
Sample221012-t8hh4acab5
SHA256 fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201
MD5 7ad64650479b9da69873612bb4d18e5d
SHA1 48f180db36159873515ea60ee21771e9fd7e561d
SHA512 b161ac768fee2bcc2bc91d8f22b83f6555e1b1b856b7207afe69972bfc3685b38e613b2e00dbc762dfd45c6e35b80b020a70a34b11ca14a0d98e34771d71e7b4
SSDEEP 12288:Z6SKqT31T6WpJY6V765jKqostkm3Ob/Jnq1wqDwKssa1:oxqT31T6WE6I5jKqosOm+b/Jnuf3a1
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

File Explorer

fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201

.exe 1.0MB

fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201

IMPHASH 2a3100a777f218dc13b45804af8d5e54
SHA256 fcb37c7d72edd8bcb08a778775425a47bd9bcf9a6d329ad67512f4bab9231201
MD5 7ad64650479b9da69873612bb4d18e5d
SHA1 48f180db36159873515ea60ee21771e9fd7e561d
SHA512 b161ac768fee2bcc2bc91d8f22b83f6555e1b1b856b7207afe69972bfc3685b38e613b2e00dbc762dfd45c6e35b80b020a70a34b11ca14a0d98e34771d71e7b4
SSDEEP 12288:Z6SKqT31T6WpJY6V765jKqostkm3Ob/Jnq1wqDwKssa1:oxqT31T6WE6I5jKqosOm+b/Jnuf3a1
MD5 SHA1 SHA512 SSDEEP

windows x86

AutoIT Executable

AutoIT scripts compiled to PE executables.

Minor OS version

Major OS version

Entry point

347453

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

recv send socket connect closesocket bind listen __WSAFDIsSet htons sendto recvfrom ntohs ioctlsocket select WSAGetLastError WSACleanup inet_addr gethostbyname WSAStartup gethostname accept

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winmm

waveOutSetVolume mciSendStringW timeGetTime

comctl32

ImageList_DragMove ImageList_EndDrag ImageList_DragLeave ImageList_DragEnter ImageList_BeginDrag ImageList_SetDragCursorImage ImageList_Destroy ImageList_ReplaceIcon ImageList_Create InitCommonControlsEx ImageList_Remove

mpr

WNetUseConnectionW WNetGetConnectionW WNetAddConnection2W WNetCancelConnection2W

kernel32

UnmapViewOfFile OpenProcess CreateFileMappingW MapViewOfFile WriteProcessMemory ReadProcessMemory CreateFileW ReadFile SetFilePointer SetFileTime FindResourceW LoadResource GetFileAttributesW LockResource FindFirstFileW SizeofResource FindClose EnumResourceNamesW DeleteFileW FindNextFileW lstrcmpiW MoveFileW OutputDebugStringW CopyFileW CreateDirectoryW RemoveDirectoryW TerminateProcess SetSystemPowerState GetLocalTime MultiByteToWideChar WideCharToMultiByte CompareStringW InterlockedIncrement InterlockedDecrement WriteFile CreatePipe GetStdHandle InterlockedExchange EnterCriticalSection TerminateThread LeaveCriticalSection DeleteCriticalSection GetTempPathW GetTempFileNameW VirtualFree FormatMessageW GetExitCodeProcess GetDriveTypeW QueryPerformanceFrequency GetVolumeInformationW SetVolumeLabelW DeviceIoControl SetErrorMode GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW SetFileAttributesW WritePrivateProfileSectionW GetShortPathNameW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetEnvironmentVariableW GetFileSize SetEnvironmentVariableW GlobalFree GlobalLock GlobalUnlock GlobalAlloc SetProcessWorkingSetSize GlobalMemoryStatus Beep GetComputerNameW GetWindowsDirectoryW GetSystemDirectoryW GetCurrentProcessId GetCurrentThread CreateProcessW SetPriorityClass VirtualAlloc LoadLibraryExW GetModuleHandleA GetCPInfo GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter RaiseException GetModuleFileNameA HeapSize HeapReAlloc HeapDestroy HeapCreate RtlUnwind QueryPerformanceCounter GetModuleHandleW GetSystemInfo GetVersionExW GetCurrentThreadId Sleep WaitForSingleObject CreateThread DuplicateHandle GetLastError HeapAlloc GetProcessHeap HeapFree CloseHandle GetCurrentProcess LoadLibraryA GetModuleFileNameW GetFullPathNameW SetCurrentDirectoryW GetConsoleCP GetConsoleMode SetHandleCount GetCurrentDirectoryW FreeLibrary InitializeCriticalSection GetProcAddress LoadLibraryW GetStartupInfoW GetVersionExA ExitProcess ExitThread GetSystemTimeAsFileTime GetFileType GetStartupInfoA SetStdHandle ResumeThread FlushFileBuffers LCMapStringA LCMapStringW GetTimeZoneInformation FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW GetTickCount GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEndOfFile CompareStringA GetDiskFreeSpaceW SetEnvironmentVariableA

user32

SetWindowLongW FlashWindow GetActiveWindow InflateRect CharNextW DrawFocusRect wsprintfW DrawTextW RedrawWindow FrameRect DrawFrameControl FillRect DrawMenuBar PtInRect DestroyMenu SetMenu DestroyAcceleratorTable CreateAcceleratorTableW GetWindowTextLengthW SetCursor GetWindowDC TranslateAcceleratorW GetSystemMetrics IsDialogMessageW CreateMenu IsDlgButtonChecked GetSysColor DefDlgProcW ReleaseCapture SetCapture SetActiveWindow FindWindowExW EnumThreadWindows LoadImageW CreateIconFromResourceEx mouse_event SetMenuDefaultItem InsertMenuItemW IsMenu TrackPopupMenuEx GetCursorPos DeleteMenu CheckMenuRadioItem GetMenuItemID GetMenuItemCount IsZoomed GetMenuItemInfoW SetForegroundWindow IsIconic FindWindowW SystemParametersInfoW GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState DispatchMessageW GetDC GetKeyboardLayoutNameA LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW DestroyWindow GetMenu GetClientRect CopyRect EndPaint BeginPaint EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowLongW GetWindowThreadProcessId AttachThreadInput SendMessageTimeoutW GetFocus GetWindowTextW ScreenToClient EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW GetCaretPos GetSubMenu GetMenuStringW IsCharUpperW IsCharLowerW IsCharAlphaNumericW IsCharAlphaW GetKeyboardLayoutNameW ClientToScreen RegisterHotKey ReleaseDC SetMenuItemInfoW GetCursor PostMessageW GetWindowRect MessageBoxW GetForegroundWindow DefWindowProcW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu MessageBoxA RegisterWindowMessageW DestroyIcon SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush TranslateMessage PeekMessageW WindowFromPoint SetClipboardData EmptyClipboard CountClipboardFormats SetWindowPos CopyImage CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard AdjustWindowRectEx SetRect CharLowerBuffW GetMessageW VkKeyScanA LockWindowUpdate UnregisterHotKey keybd_event ExitWindowsEx CharUpperW

gdi32

LineTo AngleArc MoveToEx Ellipse PolyDraw BeginPath SetTextColor GetObjectW SetBkMode RoundRect SetBkColor CloseFigure SetPixel EndPath StrokePath StrokeAndFillPath ExtCreatePen PolyBezierTo SetViewportOrgEx Rectangle CreatePen CreateSolidBrush CreateCompatibleBitmap GetPixel DeleteDC GetDIBits BitBlt SelectObject CreateDIBSection CreateCompatibleDC CreateFontW GetDeviceCaps GetTextFaceW GetStockObject CreateDCW GetTextExtentPoint32W DeleteObject

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegEnumValueW RegDeleteValueW RegDeleteKeyW RegSetValueExW RegCreateKeyExW GetUserNameW RegConnectRegistryW RegEnumKeyExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken CloseServiceHandle UnlockServiceDatabase LockServiceDatabase OpenSCManagerW RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

DragQueryPoint ShellExecuteExW DragQueryFileW SHBrowseForFolderW SHFileOperationW SHGetPathFromIDListW SHGetDesktopFolder SHGetMalloc ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoInitialize CoUninitialize CoCreateInstance CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemFree IIDFromString StringFromIID CLSIDFromString OleInitialize CreateBindCtx CLSIDFromProgID CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket StringFromCLSID OleUninitialize

oleaut32

LoadRegTypeLi SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayAllocData SafeArrayAllocDescriptorEx SysAllocString OleLoadPicture VarR8FromDec VariantTimeToSystemTime SafeArrayUnaccessData SafeArrayAccessData VariantClear VariantCopy VariantInit GetActiveObject