fd582ee639f8630cd86ce1eb960a8ba9f39bc64aff4aa68d78d3145ee4ce350a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fd582ee639f8630cd86ce1eb960a8ba9f39bc64aff4aa68d78d3145ee4ce350a
Size

1.5MB
MD5

7556914c78569620163ef778347a5cf6
SHA1

6fb49d1b176d4e8ec83fdef152e976c056c6322c
SHA256

fd582ee639f8630cd86ce1eb960a8ba9f39bc64aff4aa68d78d3145ee4ce350a
SHA512

c62ab7658ed94cb975188afe2ab8e051aad7ec9cd41fb490d520c5a69a9ff42a434eb946605995d11398c9d946b5a767fb1102c467d994faf8af2815c9307382
SSDEEP

49152:YlZi1szYAs/cYgjQeADK6oNGuqCvkQitEE:0ZXYAsmjQaUbC8QitP

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd582ee639f8630cd86ce1eb960a8ba9f39bc64aff4aa68d78d3145ee4ce350a

Files

fd582ee639f8630cd86ce1eb960a8ba9f39bc64aff4aa68d78d3145ee4ce350a
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 568KB - Virtual size: 568KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 766KB - Virtual size: 765KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ