Static task
static1
Behavioral task
behavioral1
Sample
toto-35bc90c418f4deb940f49dd93e871c543e58b9d2d2bcecbfea0b5a429cb41099.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
toto-35bc90c418f4deb940f49dd93e871c543e58b9d2d2bcecbfea0b5a429cb41099.exe
Resource
win10v2004-20231215-en
General
-
Target
toto-35bc90c418f4deb940f49dd93e871c543e58b9d2d2bcecbfea0b5a429cb41099.exe
-
Size
1.4MB
-
MD5
e9c7343998daf6b6f93ca8f41adb6fb5
-
SHA1
764f60f475179fdc35456e61f326213fed224cd3
-
SHA256
e1d71401e32bff0442f129376c493f2c671dfeda1fbeebf4f4838440ff458dd3
-
SHA512
b0f88141556091bc556424c5ab3f390f641ce76c9b5bcb9c567ee9718d09327f64ffb499d28644259bdbc9387d830d44a54ffc396ccfd4fd60b0f0b55b1c9cbe
-
SSDEEP
24576:cAHnh+eWsN3skA4RV1Hom2KXcmtc056iaCrpeF42YJsPS3/ULrO5X8:7h+ZkldoPKsac05JLeFyPue
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule sample autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource toto-35bc90c418f4deb940f49dd93e871c543e58b9d2d2bcecbfea0b5a429cb41099.exe
Files
-
toto-35bc90c418f4deb940f49dd93e871c543e58b9d2d2bcecbfea0b5a429cb41099.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 568KB - Virtual size: 567KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 191KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 661KB - Virtual size: 660KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ