Behavioral task
behavioral1
Sample
aa041fb6e92bf8da551b760fbd8e4048d1bf1069a4d0e9f6dfb683a2908147ea.exe
Resource
win7-20220901-en
General
-
Target
aa041fb6e92bf8da551b760fbd8e4048d1bf1069a4d0e9f6dfb683a2908147ea
-
Size
421KB
-
MD5
2261d59f9efdae722af0fd70cd8cd1a4
-
SHA1
6f0efc457d24bcaaca6eff311cf617ba6372bec1
-
SHA256
aa041fb6e92bf8da551b760fbd8e4048d1bf1069a4d0e9f6dfb683a2908147ea
-
SHA512
dafa7538e49ee09cf42eb8fb2343fc6fc6bd28205400ea0319864d63fe1a7f5ced12bf2db675e3ddaa88471c1cd3aa877e8e46eb88477feb90abbc0399794e85
-
SSDEEP
12288:EfnnK9zABs+TbFx9SXOPCf8DkqAR8zH6eS2f/LDloXMWQ:EfK9zUHFpi8/cSLDqXG
Malware Config
Signatures
-
resource yara_rule sample upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe
Files
-
aa041fb6e92bf8da551b760fbd8e4048d1bf1069a4d0e9f6dfb683a2908147ea.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 472KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 298KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 532KB - Virtual size: 531KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ