LPO-582-AL SAFA FA[.]exe | Triage

Sharing

General

Target

LPO-582-AL SAFA FA.exe
Size

1019KB
MD5

9bab9e325ff03efaa2afc7d9f23078c8
SHA1

908d1029a572bf252da0af3c0b04e87b16b3ba19
SHA256

2db2ce01cb77bd0981b789c62af358866171a409fdad4bef98c62a302e8348ca
SHA512

afa2b7cc1df3196206ca0432c3bc62c4d497eecdc3dadb2fd2026885f50db6aa4a71d2762017ae7fc5045b96c6939fc9a071ce23f90164ef77a63ed2e68d825c
SSDEEP

24576:NAHnh+eWsN3skA4RV1Hom2KXcmtcZf4ylHkD:sh+ZkldoPKsacZfhl

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LPO-582-AL SAFA FA.exe

Files

LPO-582-AL SAFA FA.exe
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 568KB - Virtual size: 567KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 209KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ