Behavioral task
behavioral1
Sample
ccbc99b590d6be94b165dbf1f4710e82f61e4c82a284eb74d8424ac96d316806.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ccbc99b590d6be94b165dbf1f4710e82f61e4c82a284eb74d8424ac96d316806.exe
Resource
win10v2004-20230703-en
General
-
Target
ccbc99b590d6be94b165dbf1f4710e82f61e4c82a284eb74d8424ac96d316806
-
Size
838KB
-
MD5
55e27b547bc395d88bce92b59f026289
-
SHA1
8dfbef09eeb95072b94c6166f5d9990c218b4342
-
SHA256
ccbc99b590d6be94b165dbf1f4710e82f61e4c82a284eb74d8424ac96d316806
-
SHA512
4cdf022d6abc78c24634e847c66c4f9e8314ddfef4925eb1788d6e69b5d10e6977a69830cfe3861af79e293d58d8ff27d71859f21ca97d8cbac483e981111ee1
-
SSDEEP
24576:BiUmSB/o5d1ubcvjtLTiZygfCRBvpkMH4eZNqf:B/mU/ohubcvh3Af2vEmq
Malware Config
Signatures
-
resource yara_rule sample upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/out.upx
Files
-
ccbc99b590d6be94b165dbf1f4710e82f61e4c82a284eb74d8424ac96d316806.exe windows x86
Code Sign
71:82:27:e0:53:b5:ba:91:48:04:f9:c3:6a:c0:8c:f6Certificate
IssuerCN=Draconian cc,O=cc,1.2.840.113549.1.9.1=#0c14696e666f40647261636f6e69616e2e636f2e7a61Not Before09/03/2013, 23:44Not After31/12/2039, 23:59SubjectCN=Draconian cc,O=cc,1.2.840.113549.1.9.1=#0c14696e666f40647261636f6e69616e2e636f2e7a6113:d7:54:e4:c6:d4:69:31:ef:96:e2:f3:12:5d:12:54:25:3f:93:a3Signer
Actual PE Digest13:d7:54:e4:c6:d4:69:31:ef:96:e2:f3:12:5d:12:54:25:3f:93:a3Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1008KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 370KB - Virtual size: 372KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 465KB - Virtual size: 468KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 619KB - Virtual size: 618KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 191KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 473KB - Virtual size: 472KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ