Behavioral task
behavioral1
Sample
cd79dde092707a019f34a17cbcee20c6964f16620add10ed21a9b6e2de5879ec.exe
Resource
win7-20220812-en
General
-
Target
cd79dde092707a019f34a17cbcee20c6964f16620add10ed21a9b6e2de5879ec
-
Size
1.1MB
-
MD5
557bf0358a5180f073653217ee96a087
-
SHA1
6b60ae0e84b15377d8d106c548620c4389ce0b7f
-
SHA256
cd79dde092707a019f34a17cbcee20c6964f16620add10ed21a9b6e2de5879ec
-
SHA512
2bbd4bec4994bcfd47229a60a6e7456b46089ce59e02fcacd621210841e22d6287ae32a72fe42954b1c094f45b8ea19ef17f34575951e60c9f719e552f1deb49
-
SSDEEP
24576:4FE//Tct4bOsm8Zeqsw4/+7JWDkVgg8qwimP39iFUgyuWpqLBr:qSVm8Zeqf7JWAVg9VxPySo5
Malware Config
Signatures
-
resource yara_rule sample upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe
Files
-
cd79dde092707a019f34a17cbcee20c6964f16620add10ed21a9b6e2de5879ec.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 456KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 263KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 512KB - Virtual size: 512KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ