Behavioral task
behavioral1
Sample
fcb2616b7aed23634b5922ac184f21f13b6e79cee9a515069117c07debe869a6.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
fcb2616b7aed23634b5922ac184f21f13b6e79cee9a515069117c07debe869a6.exe
Resource
win10v2004-20230703-en
General
-
Target
fcb2616b7aed23634b5922ac184f21f13b6e79cee9a515069117c07debe869a6
-
Size
1.1MB
-
MD5
0adbb02e149670ac28273dab5528e652
-
SHA1
fe57687ff68aa16d53db7be78cde15d54ae25485
-
SHA256
fcb2616b7aed23634b5922ac184f21f13b6e79cee9a515069117c07debe869a6
-
SHA512
3862afe32af7d32e5e69add57ad075eb882f4b61bbe9437bd3992eb918f2517e6210d053dd3ba489102271c81ad88afe14c30f19326c7ccc2373d9141bd3cf5f
-
SSDEEP
24576:RiUmSB/o5d1ubcvWD/koz4Gm8ZgEAlwiOWImiVok1F4Hh81+pSOTKaonV9:R/mU/ohubcv+/PdqEawTWImi5id9on
Malware Config
Signatures
-
resource yara_rule sample upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/out.upx
Files
-
fcb2616b7aed23634b5922ac184f21f13b6e79cee9a515069117c07debe869a6.exe windows x86
Code Sign
71:82:27:e0:53:b5:ba:91:48:04:f9:c3:6a:c0:8c:f6Certificate
IssuerCN=Draconian cc,O=cc,1.2.840.113549.1.9.1=#0c14696e666f40647261636f6e69616e2e636f2e7a61Not Before09/03/2013, 23:44Not After31/12/2039, 23:59SubjectCN=Draconian cc,O=cc,1.2.840.113549.1.9.1=#0c14696e666f40647261636f6e69616e2e636f2e7a6183:a7:bf:83:ab:40:19:26:07:ac:58:b8:9f:66:a1:57:f2:d0:56:7eSigner
Actual PE Digest83:a7:bf:83:ab:40:19:26:07:ac:58:b8:9f:66:a1:57:f2:d0:56:7eDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 371KB - Virtual size: 372KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 764KB - Virtual size: 768KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 619KB - Virtual size: 618KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 191KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 772KB - Virtual size: 772KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ