Behavioral task
behavioral1
Sample
8699b21896970e07bdd7bdaf0481f0da8ca43631498274c75be0b57962fedf98.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8699b21896970e07bdd7bdaf0481f0da8ca43631498274c75be0b57962fedf98.exe
Resource
win10v2004-20231215-en
General
-
Target
8699b21896970e07bdd7bdaf0481f0da8ca43631498274c75be0b57962fedf98
-
Size
715KB
-
MD5
d69c14da22cce3ac08b97c4f7307e6df
-
SHA1
3c70d5d4b042f521b543d4715e8cfcc32a005068
-
SHA256
8699b21896970e07bdd7bdaf0481f0da8ca43631498274c75be0b57962fedf98
-
SHA512
84ff2f875898a0c5e38af74d8a91f92bd3a92bb9553e39879191422112842c69900b64812bd088a334f91d29514d9537f74f0e1cf9403c800dc5902fe84141e5
-
SSDEEP
12288:YsHzOUNUSB/o5LsI1uwajJ5yvv1l2WT7bjSqO6BIKI1VH2xfn7vP9:riUmSB/o5d1ubcv/PiqO6qK1fn73
Malware Config
Signatures
-
resource yara_rule sample upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 8699b21896970e07bdd7bdaf0481f0da8ca43631498274c75be0b57962fedf98 unpack001/out.upx
Files
-
8699b21896970e07bdd7bdaf0481f0da8ca43631498274c75be0b57962fedf98.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 884KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 370KB - Virtual size: 372KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 344KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 619KB - Virtual size: 618KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 191KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 352KB - Virtual size: 351KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ