Behavioral task
behavioral1
Sample
RV Envo de Factura 406000844.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
RV Envo de Factura 406000844.exe
Resource
win10v2004-20240412-en
General
-
Target
d6fa4abfbefcb465bce0309f4d224d626492ca0fec2c48062f1d6c1c5c97b3f5
-
Size
660KB
-
MD5
ce6bd2bca7186b627b9564641a749ccc
-
SHA1
62eb31a4fb020e712f14cb0b69710f7c45729365
-
SHA256
d6fa4abfbefcb465bce0309f4d224d626492ca0fec2c48062f1d6c1c5c97b3f5
-
SHA512
d864186b3d6e44dbc841cfea5806f5bae4b02e2783c19b6f428985dd2560b3191a1222c9c2fc6681b809b0cefa30195382ae49aa009f3df716a8521d799dc8a6
-
SSDEEP
12288:OPP2D8bEeTTZpy3r22yFBd4r+F0dXd+WdP0CMgvXs2qYmJEueM2ZeMqzNr:OODi63r22CIr+FIemsZPWMv/Nr
Malware Config
Signatures
-
resource yara_rule static1/unpack001/RV Envo de Factura 406000844.exe upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/RV Envo de Factura 406000844.exe unpack002/out.upx
Files
-
d6fa4abfbefcb465bce0309f4d224d626492ca0fec2c48062f1d6c1c5c97b3f5.zip
-
RV Envo de Factura 406000844.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 840KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 370KB - Virtual size: 372KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 298KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 619KB - Virtual size: 618KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 191KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 306KB - Virtual size: 305KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ