Static task
static1
Behavioral task
behavioral1
Sample
0a4971dcb11571c926a1c7b89638d70908a0fa67c3aac017df82ecfc48f01184.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
0a4971dcb11571c926a1c7b89638d70908a0fa67c3aac017df82ecfc48f01184.exe
Resource
win10v2004-20231023-en
General
-
Target
b1063014514bb28892af7f06182a4624.bin
-
Size
281KB
-
MD5
d53ea9a3f413234a9ca4a9b86c2d8b96
-
SHA1
05727d08ddcfbb43208bb90cdb553532e2d76e6c
-
SHA256
e08131d3891b047ff1c29459d79c661cb504c6eb80292c9be88faf1167e8dd59
-
SHA512
2f94593c2cffe7a02f00d006d2e5535e26231c1c007df9aa8799019414ad28257be1b4e4223802f7bb70510c29a202e4b09ff89de48a28c9604d0538cf51a7cc
-
SSDEEP
6144:D6Ae0AKHIAM5AyOddacEmQhU7CuhwBIDTWCq43QjOs:D7e0JHIADvEmYUdWBIeCz3QjB
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/0a4971dcb11571c926a1c7b89638d70908a0fa67c3aac017df82ecfc48f01184.exe autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/0a4971dcb11571c926a1c7b89638d70908a0fa67c3aac017df82ecfc48f01184.exe
Files
-
b1063014514bb28892af7f06182a4624.bin.zip
Password: infected
-
0a4971dcb11571c926a1c7b89638d70908a0fa67c3aac017df82ecfc48f01184.exe.exe windows:5 windows x86 arch:x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 516KB - Virtual size: 516KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ