Behavioral task
behavioral1
Sample
AutoCAD 2010.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
AutoCAD 2010.exe
Resource
win10v2004-20230220-en
General
-
Target
AutoCAD portable.rar
-
Size
161.9MB
-
MD5
b091c45cf118b4d7db8af60f5687cf69
-
SHA1
556a07f7a41af3e58726722d99f6e4b3fcf78168
-
SHA256
ee40dc0fffb002e0ed209b0412fab6ca5ca8eeebff8b5d936283ddfc5f285d10
-
SHA512
b3fba73736297591aaa1c21484d91aac24de6844b667b2dd4d2e1a17af3d23f703b732748e6f53b232156b42532bdeb8078ce50ae229728536533c4984ceade3
-
SSDEEP
3145728:0PoxmpHaHcPwhJzJLNwyc0yvZeT306FInMu0CVnIcaos8tzJ5suCu2pJCIu4bh:0PtkqKJzJLNPc0saInr0CJfnJCu27CVQ
Malware Config
Signatures
-
Raccoon family
Files
-
AutoCAD portable.rar.rar
-
AutoCAD 2010.exe.exe windows x86
fc9ae8768553a9930f55be6801914203
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetModuleHandleW
Sleep
GetLastError
MoveFileW
GetSystemTimeAsFileTime
DeleteFileW
lstrcpyW
lstrlenW
GetEnvironmentVariableW
lstrcmpA
lstrlenA
UnmapViewOfFile
VirtualAlloc
VirtualFree
GetProcAddress
GetModuleHandleA
SetLastError
VirtualProtect
LoadLibraryA
LoadLibraryExA
lstrcatA
lstrcpyA
GetModuleFileNameA
HeapFree
FreeLibrary
HeapAlloc
GetProcessHeap
LoadLibraryW
LoadLibraryExW
lstrcatW
ReadFile
SetFilePointer
ExitProcess
FormatMessageA
GetCurrentProcess
SetEnvironmentVariableW
CloseHandle
GetFileSize
CreateFileW
WideCharToMultiByte
lstrcpynW
OutputDebugStringW
GetFileAttributesW
user32
wsprintfW
MessageBoxA
ntdll
NtProtectVirtualMemory
NtClose
LdrLoadDll
RtlInitUnicodeString
NtMapViewOfSection
NtCreateSection
LdrGetProcedureAddress
NtUnmapViewOfSection
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.res Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ