Behavioral task
behavioral1
Sample
216714c804d28a4371e46c2018688e769ae0967a17c23558538bac70abf9277b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
216714c804d28a4371e46c2018688e769ae0967a17c23558538bac70abf9277b.exe
Resource
win10v2004-20221111-en
General
-
Target
216714c804d28a4371e46c2018688e769ae0967a17c23558538bac70abf9277b
-
Size
956KB
-
MD5
b602f409c96f0e5345926d782f7bedd5
-
SHA1
d8948fa991e1b00a962a2d82a03028e0a716c2a5
-
SHA256
216714c804d28a4371e46c2018688e769ae0967a17c23558538bac70abf9277b
-
SHA512
8d83c17b5b3c48da3fada0dad76cd347805b5ceb2d1896727bd522b64a5bb68d896a199d6e769e7f96f69a6bbb0519fa389d9fe3ab08fca178f25db8fb7f3f40
-
SSDEEP
24576:FtARoeMEIrQhZxxEMcF8f3ilvvqi1EeiC97o5bpf9Lm8:FtARoeMt+ZQDFkylv9EeiC9OfZm8
Malware Config
Signatures
-
resource yara_rule sample upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe
Files
-
216714c804d28a4371e46c2018688e769ae0967a17c23558538bac70abf9277b.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 420KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 253KB - Virtual size: 256KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 495KB - Virtual size: 495KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ