e45789ee855075fee199fbc821e6483b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e45789ee855075fee199fbc821e6483b
Size

899KB
MD5

e45789ee855075fee199fbc821e6483b
SHA1

77d70cf95c3c4718b81c99fcc5fe42c70ce0d8b7
SHA256

637301828963e45feed54809afeb97bb30fba397d2a1dc7076686538918651bd
SHA512

89d54a1d29abdb2978ad4a7e692166fb99db0307b1e1df2f47972b156b3b882b79ca9fedcdc5e6e1184cf4304810195e6ea35591e09a6c01b02682e5aa136f02
SSDEEP

12288:PAHn2JK+HemNsqI3etnBHYPpAkApyRV3jRfP4S5LH28U3mcQuKXgoggdntcs9Pk:PAHnh+eWsN3skA4RV1Hom2KXcmtciPk

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e45789ee855075fee199fbc821e6483b

Files

e45789ee855075fee199fbc821e6483b
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 568KB - Virtual size: 567KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ