Ranieri RFQ.rar.pellet
- SHA256 54cdf582c37ff878e8bcb09fab72aca6dc6292d25b7d62b13ec4e7b4cdfe3cfc
Behavioral task
behavioral1
Sample
Ranieri RFQ.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
- Target Ranieri RFQ.rar.pellet
- Size 881KB
- Sample240301-lth73sfb7w
- SHA256 54cdf582c37ff878e8bcb09fab72aca6dc6292d25b7d62b13ec4e7b4cdfe3cfc
- MD5 95c1f5cb97e5ae962cc98b9c983674c4
- SHA1 fffc75b044ee065b627b59429ad1a9b02ad64d04
- SHA512 259f84ce462ee83e86e4c8fb01bf1a7b2f31f03eddce5ce6981b1a007fd772694f292c15744227fcb91e3950e5a70e51661d6ab7af67ad9107fb7d3c83941492
- SSDEEP 24576:RiCRMQKTf2VP6+5w8YJKN5cblqe9kYhLzinmLQ8vJerQd/PIKsG:RiiMffuNW2Sblqe9kac8vJer85sG
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Ranieri RFQ.exe upx - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Ranieri RFQ.exe unpack002/out.upx
File Explorer
-
Ranieri RFQ.rar.pellet.rar 881KB
-
Ranieri RFQ.exe.exe 1.0MB
-
out.upx.exe 1.5MB
Ranieri RFQ.exe
- SHA256 e500b83db91a16021dc5f38a5cfacd4262a43c34bba5fa7211409e0ace06c85a
- MD5 c97fe137ae1f90eff1e269cee50bbd03
- SHA1 6bbd3375183ae7165bebfe4ed911a7436c518ae4
- SHA512 13808cd71f267d6328c617f561c5aa120c65877ca3e6f936ac992099eb7a28649b67a0fb6e19f31ccf217e6a0d80dcb191d4a62bdddd11fbaccefe7b076f30c7
- SSDEEP 24576:+iUmSB/o5d1ubcvi32l/pvcOa0mqL5mPAjZy:+/mU/ohubcvNlhZ5mPgZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1607552
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
371KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
655KB
Virtual Size
656KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
out.upx
- SHA256 48bcbba25864d96b14adaeac91506fda5bd6dacabd717f121cdda629a4d89d5c
- MD5 eab87a192ead3f5f30087af043a05d69
- SHA1 d9ef8b08554b9a62e9fb84da8018ee87f6ca7f4c
- SHA512 2d3598de2502a72a5a6ec72f1c0f0503187bdee2d64189c21ac4f1a9628f0bd9a1a774b2e22500851d40d9c71b3590e8afdbc15c1fc2cdde5a4f8d8aa7ee53a8
- SSDEEP 24576:rqDEvCTbMWu7rQYlBQcBiT6rp3d032l/pvcOa0mqL5mPAjZy:rTvC/MTQYxsW5llhZ5mPgZ
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
132471
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
619KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
662KB
Virtual Size
662KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,