PO-38667-3866447 MAYOREO FERRETERO ATLAS SA DE CV[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
PO-38667-3866447 MAYOREO FERRETERO ATLAS SA DE CV.exe
Size 866KB
Sample240206-yd39jaeee4
SHA256 3daec2c8b6b1871c842499e95631be488a15404418ee31552bd84166bbe18167
MD5 554eaa018fe4722e26bbe54ea7d2cd10
SHA1 ae633cb30c88d460d4be8074edca6051d7387e96
SHA512 e11f502310810990a4f11b9de01a1a711e56351cf731350a84f401ba545de048652e6b73879d03c2198759ec3f632256468831f645c3f733b40733f44912bf58
SSDEEP 12288:jhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4agoXTyq6jZjijZ1ttFOEV:pRmJkcoQricOIQxiZY1iaPDyqQAdl
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PO-38667-3866447 MAYOREO FERRETERO ATLAS SA DE CV.exe

File Explorer

PO-38667-3866447 MAYOREO FERRETERO ATLAS SA DE CV.exe

.exe 866KB

PO-38667-3866447 MAYOREO FERRETERO ATLAS SA DE CV.exe

IMPHASH 04b4eec1b14791bf23f31173f27a5df0
SHA256 3daec2c8b6b1871c842499e95631be488a15404418ee31552bd84166bbe18167
MD5 554eaa018fe4722e26bbe54ea7d2cd10
SHA1 ae633cb30c88d460d4be8074edca6051d7387e96
SHA512 e11f502310810990a4f11b9de01a1a711e56351cf731350a84f401ba545de048652e6b73879d03c2198759ec3f632256468831f645c3f733b40733f44912bf58
SSDEEP 12288:jhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4agoXTyq6jZjijZ1ttFOEV:pRmJkcoQricOIQxiZY1iaPDyqQAdl
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

91585

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

__WSAFDIsSet setsockopt ntohs recvfrom sendto htons select listen WSAStartup bind closesocket connect socket send WSACleanup ioctlsocket accept WSAGetLastError inet_addr gethostbyname gethostname recv

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove ImageList_ReplaceIcon ImageList_Create InitCommonControlsEx ImageList_Destroy

mpr

WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W WNetUseConnectionW

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetConnectW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetQueryOptionW InternetQueryDataAvailable

psapi

EnumProcesses GetModuleBaseNameW GetProcessMemoryInfo EnumProcessModules

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock UnloadUserProfile LoadUserProfileW

kernel32

HeapAlloc Sleep GetCurrentThreadId RaiseException MulDiv GetVersionExW GetSystemInfo InterlockedIncrement InterlockedDecrement WideCharToMultiByte lstrcpyW MultiByteToWideChar lstrlenW lstrcmpiW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW FindClose DeleteFileW FindNextFileW MoveFileW CopyFileW CreateDirectoryW RemoveDirectoryW GetProcessHeap QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource EnumResourceNamesW OutputDebugStringW GetLocalTime CompareStringW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetStdHandle CreatePipe InterlockedExchange TerminateThread GetTempPathW GetTempFileNameW VirtualFree FormatMessageW GetExitCodeProcess SetErrorMode GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW DeviceIoControl SetFileAttributesW GetShortPathNameW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetCurrentThread GetProcessIoCounters CreateProcessW SetPriorityClass LoadLibraryW VirtualAlloc LoadLibraryExW HeapFree WaitForSingleObject CreateThread DuplicateHandle GetLastError CloseHandle GetCurrentProcess GetProcAddress LoadLibraryA FreeLibrary GetModuleFileNameW GetFullPathNameW SetCurrentDirectoryW IsDebuggerPresent GetCurrentDirectoryW ExitProcess ExitThread GetSystemTimeAsFileTime ResumeThread GetTimeFormatW GetDateFormatW GetCommandLineW GetStartupInfoW IsProcessorFeaturePresent HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter GetStringTypeW HeapCreate SetHandleCount GetFileType SetStdHandle GetConsoleCP GetConsoleMode LCMapStringW RtlUnwind SetFilePointer GetTimeZoneInformation FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount HeapReAlloc WriteConsoleW SetEndOfFile SetSystemPowerState SetEnvironmentVariableA

user32

GetCursorInfo RegisterHotKey ClientToScreen GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW ReleaseCapture SetCapture WindowFromPoint LoadImageW CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu TrackPopupMenuEx GetCursorPos DeleteMenu CheckMenuRadioItem SetWindowPos GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic FindWindowW SystemParametersInfoW TranslateMessage SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowLongW AttachThreadInput GetFocus GetWindowTextW ScreenToClient SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity GetUserObjectSecurity CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation OpenWindowStationW MessageBoxW DefWindowProcW CopyImage AdjustWindowRectEx SetRect SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard BlockInput GetMessageW LockWindowUpdate GetMenuItemID DispatchMessageW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon PeekMessageW UnregisterHotKey CharLowerBuffW keybd_event MonitorFromRect GetWindowThreadProcessId

gdi32

DeleteObject AngleArc GetTextExtentPoint32W ExtCreatePen StrokeAndFillPath StrokePath EndPath SetPixel CloseFigure CreateCompatibleBitmap CreateCompatibleDC SelectObject StretchBlt GetDIBits GetDeviceCaps MoveToEx DeleteDC GetPixel CreateDCW Ellipse PolyDraw BeginPath Rectangle SetViewportOrgEx GetObjectW SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush SetTextColor CreateFontW GetTextFaceW GetStockObject LineTo

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegCreateKeyExW GetUserNameW RegConnectRegistryW CloseServiceHandle UnlockServiceDatabase OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW InitializeSecurityDescriptor InitializeAcl GetLengthSid CopySid LogonUserW LockServiceDatabase GetTokenInformation GetSecurityDescriptorDacl GetAclInformation GetAce AddAce SetSecurityDescriptorDacl RegOpenKeyExW RegQueryValueExW AdjustTokenPrivileges InitiateSystemShutdownExW OpenSCManagerW RegCloseKey

shell32

DragQueryPoint ShellExecuteExW SHGetFolderPathW DragQueryFileW SHEmptyRecycleBinW SHBrowseForFolderW SHFileOperationW SHGetPathFromIDListW SHGetDesktopFolder SHGetMalloc ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CLSIDFromString StringFromGUID2 CoInitialize CoUninitialize CoCreateInstance CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemFree ProgIDFromCLSID OleInitialize CreateBindCtx CLSIDFromProgID CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket OleUninitialize IIDFromString

oleaut32

VariantChangeType VariantCopyInd DispCallFunc CreateStdDispatch CreateDispTypeInfo SysFreeString SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnaccessData SysStringLen SafeArrayAllocData GetActiveObject QueryPathOfRegTypeLi SafeArrayAllocDescriptorEx SafeArrayCreateVector SysAllocString VariantCopy VariantClear VariantTimeToSystemTime VarR8FromDec SafeArrayGetVartype OleLoadPicture SafeArrayAccessData VariantInit