Behavioral task
behavioral1
Sample
384117b18a1237e7b06ba1a8680480a6cf38449528a211fb62033d42cacafe86.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
384117b18a1237e7b06ba1a8680480a6cf38449528a211fb62033d42cacafe86.exe
Resource
win10v2004-20221111-en
General
-
Target
384117b18a1237e7b06ba1a8680480a6cf38449528a211fb62033d42cacafe86
-
Size
500KB
-
MD5
22a3d7b7c6b958b5fe6230d17b69c61f
-
SHA1
0a3422e6283e5d9f2217c358966aa56081accd1c
-
SHA256
384117b18a1237e7b06ba1a8680480a6cf38449528a211fb62033d42cacafe86
-
SHA512
a6413445e467737bc78fa7a396aacdb0e28c393257adc553394868c3a73a31dae4a1c568b0bbaaa48e46723b16282629291309468e7f6661e4a9f1f2844dc3df
-
SSDEEP
6144:euIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qL5C5Vn+jwXYeU4jdCc9cFR:V6Wq4aaE6KwyF5L0Y2D1PqL5C7aGMcGP
Malware Config
Signatures
-
resource yara_rule sample upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe
Files
-
384117b18a1237e7b06ba1a8680480a6cf38449528a211fb62033d42cacafe86.exe windows x86
Code Sign
f3:7a:e2:02:7e:b7:5d:e3Certificate
IssuerCN=GrandLyon (DSIT),OU=DSIT,O=GrandLyon,L=Lyon,ST=Rhone,C=FRNot Before12/06/2008, 11:09Not After10/06/2018, 11:09SubjectCN=GrandLyon (DSIT),OU=DSIT,O=GrandLyon,L=Lyon,ST=Rhone,C=FR2a:2aCertificate
IssuerCN=GrandLyon (DSIT),OU=DSIT,O=GrandLyon,L=Lyon,ST=Rhone,C=FRNot Before17/04/2014, 16:01Not After17/06/2015, 16:01SubjectCN=extdkhe,O=GrandLyon,L=Lyon,ST=Rhone,C=FR65:b4:40:55:2a:90:bf:7f:42:fe:e8:bc:e6:f5:5c:19:79:47:9e:8aSigner
Actual PE Digest65:b4:40:55:2a:90:bf:7f:42:fe:e8:bc:e6:f5:5c:19:79:47:9e:8aDigest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=extdkhe,O=GrandLyon,L=Lyon,ST=Rhone,C=FR17/11/2022, 13:14 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 628KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 264KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 187KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 514KB - Virtual size: 513KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 195KB - Virtual size: 194KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ