459120568.zip
- SHA256 0fc6ed0c9e43593b88d61614e3b17877cf361599862b0659152f4c7cc00fc797
Password
Virus
Behavioral task
behavioral1
Sample
459120568.zip
Resource
win10v2004-20240221-de
windows10-2004-x64
3 signatures
1800 seconds
Behavioral task
behavioral2
Sample
459120568.exe
Resource
win10v2004-20240221-de
windows10-2004-x64
23 signatures
1800 seconds
Behavioral task
behavioral3
Sample
out.exe
Resource
win10v2004-20240221-de
windows10-2004-x64
0 signatures
1800 seconds
General
- Target 459120568.zip
- Size 874KB
- Sample240224-3n27fagg75
- SHA256 0fc6ed0c9e43593b88d61614e3b17877cf361599862b0659152f4c7cc00fc797
- MD5 aa330af924e28f830f056e63fc8409e6
- SHA1 164461f63c94d5652bd1a56bb51fe256f902529e
- SHA512 d080e09f03f184bb54aa0d50ee9fef03d90efb699f21e36942aa6884a98898284eac5194aa060587f61c97a1769a6bef4d0750dae152252f5d93f15f9b7d1951
- SSDEEP 12288:EfAN2COO6pe6sYI7NlGAgw/+KSWYZ3xCLk91cIBamKerQ1AWA0YGQXNGsO:EfANLz8e6slpg3ELkLcKQ19A0XUgsO
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/459120568.exe upx - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/459120568.exe unpack002/out.upx
File Explorer
-
459120568.zip.zip 874KB
-
459120568.exe.exe 1020KB
-
out.upx.exe 1.5MB
459120568.exe
- SHA256 53c00aee40c92375daef04e2cb894f532c3c0eac1d8d53f0315c8d981ba3c883
- MD5 421be0c5e144b6f0945b421839ce8841
- SHA1 8ff552d574e4f581cd776c6c58fd0f735be4a085
- SHA512 0f5d1a4d940a42338bfbaa212bb50507b691044987605821d996ab1a6c8217325bce73aa61a95cd40e24f82c2ed4b0c898a3ea4ef476779c5fe77a8f0950821d
- SSDEEP 24576:EiUmSB/o5d1ubcvhjLtp8L1FrPIAyvkJK4wQtmD4y:E/mU/ohubcvhjm11POvixj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Virus
Minor OS version
1
Major OS version
5
Entry point
1599360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
371KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
648KB
Virtual Size
652KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
out.upx
- SHA256 6190ac5799558b790f98789d2a455e0ef4fe054e18093468c4bda8def5bf4e9d
- MD5 bbb31ed9752e8b2cd83df98b0d480930
- SHA1 2250c8b321ad3cb3a09c351764101443fcf551b7
- SHA512 9d939f127278c6d29f454ba3a9807455c8930d14c97f084c1369960ace821e380d9875c95dc2dc6d97503f08b214451093fc7d5d73cfc2802580d259c4c84f14
- SSDEEP 24576:8qDEvCTbMWu7rQYlBQcBiT6rp3djtp8L1FrPIAyvkJK4wQtmD4y:8TvC/MTQYxsW5c11POvixj
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
132471
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
619KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
656KB
Virtual Size
655KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,