Static task
static1
Behavioral task
behavioral1
Sample
2867ebe7d83fb80174fb7bce2c73ff7a0f776fd57b9212294250335402b68809.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
2867ebe7d83fb80174fb7bce2c73ff7a0f776fd57b9212294250335402b68809.exe
Resource
win10v2004-20230621-en
General
-
Target
f5ab865e06146180d569e6a15ff6823c.bin
-
Size
1.1MB
-
MD5
6cd09c0e2b9e0b12109d44ce25ca667c
-
SHA1
76da882918afd7914c1e1db665933676e1f8f1c4
-
SHA256
a99e391a399a7674adbd4aed3c2bcecf18a3550a78c6c6c55ed1e059247628d1
-
SHA512
00ed8e77cf5ae601e4f40e2c4d970523d3e571da2ecc6f67f934cf4c07cd1b22be72f65c841c32de7e3b5eba1f0504ff92c6b7e09904b477d426080925b01ded
-
SSDEEP
24576:5G43LiPXFyBYG0DI4HF7dIFN7X8Xj35UubgSm/LzXNrbAXesUopTYNq:c8LifF3BlZIFN7sTJa/fXNXw2Nq
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/2867ebe7d83fb80174fb7bce2c73ff7a0f776fd57b9212294250335402b68809.exe autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/2867ebe7d83fb80174fb7bce2c73ff7a0f776fd57b9212294250335402b68809.exe
Files
-
f5ab865e06146180d569e6a15ff6823c.bin.zip
Password: infected
-
2867ebe7d83fb80174fb7bce2c73ff7a0f776fd57b9212294250335402b68809.exe.exe windows x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 560KB - Virtual size: 559KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 796KB - Virtual size: 795KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ