d766efb9986b4e40913328ab296aa74b | Triage

Sharing

General

Target

d766efb9986b4e40913328ab296aa74b
Size

843KB
MD5

d766efb9986b4e40913328ab296aa74b
SHA1

1ede7b7de20bcbe0768f0fa2f3372f31e410e613
SHA256

579e9ff8bee5689bcbb3523a57a64a47708419020e04532d1d129bca8a95cc01
SHA512

596c302c6f43b9b8ae63041304e32eccc6d7c78754ea6faf797a63ebd46c6ac89bfc9335ae0e13f54725bf375a3f8a9bd770b0ea5bd4ef11e29d2d58bbaccd7f
SSDEEP

12288:64lsXvtCcmVVXzzn4PJAahPl/QEdIMiVbHydETJnJWkYtx78:64lavt0LkLL9IMixoEFNYP8

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d766efb9986b4e40913328ab296aa74b

Files

d766efb9986b4e40913328ab296aa74b
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 560KB - Virtual size: 559KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 178KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ