9a4892d2ccca5140df3413b8c0ada0ab16dc02f997eeeef87d96d5084e8dc09e

Sharing

Copy URL Twitter E-mail

General

Target

9a4892d2ccca5140df3413b8c0ada0ab16dc02f997eeeef87d96d5084e8dc09e
Size

3.2MB
MD5

e4fd1ed87c0db88cdc4ae2702bac7f2d
SHA1

5895d6dbc5b9543f9381678b8a11181eb4e4fc05
SHA256

9a4892d2ccca5140df3413b8c0ada0ab16dc02f997eeeef87d96d5084e8dc09e
SHA512

6cf981954553510714bbdeb6b3399407513306a06f909050416f3a96360be1e0387e3ebdeaaa3de21322c53f54beaedc20d6347d310b2386f31795ed0cbb665d
SSDEEP

98304:RAkYTYAEJKaoMQ+4CtJpjkV/plGNgE3fHq7Kf:2kYfFT2pA/y/AKf

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/OrderMonitor_20220818/OrderMonitor/AutoUpdate.exe	upx
static1/unpack001/OrderMonitor_20220818/OrderMonitor/OrderMon.exe	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack002/out.upx	autoit_exe

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/OrderMonitor_20220818/OrderMonitor/AutoUpdate.exe
unpack002/out.upx
unpack001/OrderMonitor_20220818/OrderMonitor/GetTdxCodeName.exe
unpack001/OrderMonitor_20220818/OrderMonitor/OrderMon.exe

Files

9a4892d2ccca5140df3413b8c0ada0ab16dc02f997eeeef87d96d5084e8dc09e
.zip
OrderMonitor_20220818/OrderMonitor/AutoUpdate.exe
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 440KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 261KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 508KB - Virtual size: 508KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OrderMonitor_20220818/OrderMonitor/CustomCodeNameTable.txt
OrderMonitor_20220818/OrderMonitor/DemoSignal.tn6
OrderMonitor_20220818/OrderMonitor/GetTdxCodeName.exe
.exe windows x86

b4d1e7491d1c826e3549e2f513e343e2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Beep
WideCharToMultiByte
MultiByteToWideChar
RtlUnwind
RaiseException
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
LCMapStringA
LCMapStringW
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
GetCPInfo
CompareStringA
CompareStringW
GetLastError
CloseHandle
SetFilePointer
FlushFileBuffers
HeapFree
SetUnhandledExceptionFilter
HeapAlloc
HeapReAlloc
VirtualFree
VirtualAlloc
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
GetStringTypeW
SetConsoleCtrlHandler
GetTimeZoneInformation
SetStdHandle
CreateFileA
IsBadCodePtr
ReadFile
GetACP
GetOEMCP
SetEndOfFile
GetLocaleInfoW
SetEnvironmentVariableA
GetFileAttributesA

Sections

.text
Size: 476KB - Virtual size: 473KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OrderMonitor_20220818/OrderMonitor/OrderMon.exe
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 452KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 261KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
OrderMonitor_20220818/OrderMonitor/OrderMon.ini
OrderMonitor_20220818/OrderMonitor/StockCodeNameTable.txt
OrderMonitor_20220818/OrderMonitor/TdxSignal.ini
OrderMonitor_20220818/OrderMonitor/źżOrderMon_v1.68.pdf
.pdf
OrderMonitor_20220818/OrderMonitor/ʾ.wav

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 440KB

UPX1 Size: 261KB - Virtual size: 264KB

.rsrc Size: 5KB - Virtual size: 8KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 508KB - Virtual size: 508KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 26KB - Virtual size: 105KB

.rsrc Size: 8KB - Virtual size: 7KB

b4d1e7491d1c826e3549e2f513e343e2

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 476KB - Virtual size: 473KB

.rdata Size: 36KB - Virtual size: 32KB

.data Size: 24KB - Virtual size: 31KB

.idata Size: 4KB - Virtual size: 2KB

.reloc Size: 16KB - Virtual size: 15KB

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 452KB

UPX1 Size: 261KB - Virtual size: 264KB

.rsrc Size: 13KB - Virtual size: 16KB

UPX0
Size: - Virtual size: 440KB

UPX1
Size: 261KB - Virtual size: 264KB

.rsrc
Size: 5KB - Virtual size: 8KB

.text
Size: 508KB - Virtual size: 508KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 26KB - Virtual size: 105KB

.rsrc
Size: 8KB - Virtual size: 7KB

.text
Size: 476KB - Virtual size: 473KB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 24KB - Virtual size: 31KB

.idata
Size: 4KB - Virtual size: 2KB

.reloc
Size: 16KB - Virtual size: 15KB

UPX0
Size: - Virtual size: 452KB

UPX1
Size: 261KB - Virtual size: 264KB

.rsrc
Size: 13KB - Virtual size: 16KB