Static task
static1
Behavioral task
behavioral1
Sample
1c2c40d5632e8c96c5c1c89ce25d509d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1c2c40d5632e8c96c5c1c89ce25d509d.exe
Resource
win10v2004-20231215-en
General
-
Target
1c2c40d5632e8c96c5c1c89ce25d509d
-
Size
1.1MB
-
MD5
1c2c40d5632e8c96c5c1c89ce25d509d
-
SHA1
ebdd17061924f8d9f6e2d22b4e47ea701f747fe9
-
SHA256
40405a2957865a4a08f8a4aa99f75cae76e94892094cb459ed76969f75f1b6e2
-
SHA512
8a89ae7f8ed93acdb49b0bfb3b8ef69ec40c8fd08394bc8552f906c7649176ead84f6c6c40a99d9375a91b8af4210aa8fb45431a68d0b8ec8e7b9d50f5c40685
-
SSDEEP
12288:apqiC/2OjAt4CP4cejGSOCRK2CGYP/qts2V8f:apo/2xtxPJLfCRK2CGYPSe2Y
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule sample autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1c2c40d5632e8c96c5c1c89ce25d509d
Files
-
1c2c40d5632e8c96c5c1c89ce25d509d.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 495KB - Virtual size: 495KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 11KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 90KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ordata Size: 207KB - Virtual size: 208KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dlgyqft Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 191KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
abyjpkc Size: 30KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
euemwbu Size: 5KB - Virtual size: 72KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE