GDVCDDD.tmp.zip
- SHA256 be32aacbb47498a6126f1f1b2318be29431ebd6fbd09812a61d734b6c1f14574
Password
infected
Behavioral task
behavioral1
Sample
AWB JGS-002-20240507 DOCUNMENTS.exe
Resource
win7-20240419-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
AWB JGS-002-20240507 DOCUNMENTS.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
out.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
out.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target GDVCDDD.tmp.zip
- Size 787KB
- Sample240509-2lc9vsaf7t
- SHA256 be32aacbb47498a6126f1f1b2318be29431ebd6fbd09812a61d734b6c1f14574
- MD5 5f71607d12581d8d425c75bb47e09505
- SHA1 76f9f40e8bcdbebf7dbf3625c9e8e930011eb56a
- SHA512 e39e4e9896a84df890d73473873a02541a758cbded50b5b242c170ff39bd3f7749ec8c3210ba55439e033eb69c93c9f435981c5432f2ca3c7158110dfcf7b537
- SSDEEP 12288:PsCwfpg4MpBlhFNyfwOJ9rA2rlCfu5yp5Fdayk6qX0LZhBWlhrn8zvaMvaKpmzxD:PsGpBlhyYKhPA2spTZk6qX0N/iiaKsoq
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack002/AWB JGS-002-20240507 DOCUNMENTS.exe upx - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack003/out.upx autoit_exe - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/AWB JGS-002-20240507 DOCUNMENTS.exe unpack003/out.upx
File Explorer
-
GDVCDDD.tmp.zip.zip 787KB
-
GDVCDDD.tmp.rar 786KB
-
AWB JGS-002-20240507 DOCUNMENTS.exe.exe 811KB
-
out.upx.exe 1.3MB
GDVCDDD.tmp
- SHA256 9c8878d74fd53d35014a8b05b84ed050fd39fd9f0e952b7d86908c9dddce539e
- MD5 3733439466766de65cac2fe2d13d7a82
- SHA1 593fa4a02dd78188e9904182f8b95d64e38f5ab5
- SHA512 5e0f9c7fb1c76ee01f51891b888754ee7c296b894f6b0c3275b11dd0e6bfbbb354c30ebd4d90d2b8890c84bfdf3e295c684a136d058a500c3c477e35a0dfd249
- SSDEEP 24576:PeNwy4tlzzC4tcgvlJpFIgsX/WNMuaeCU8H21ErRKnu9:Powyilzzq0lJpFAXQKXPcn8
- MD5 SHA1 SHA512 SSDEEP
AWB JGS-002-20240507 DOCUNMENTS.exe
- SHA256 8e74e39d47f93876716dd58b3aa2d0e009a67354b5eb09a12bdd65ac9a319ba7
- MD5 ee60d483d59011c989fc7a56deca8923
- SHA1 dd414ba3307c37ff440c7bb84410f803acaaa711
- SHA512 313695b597d205432e27ac65be3c028686ffa2dd98bd3543ba09659997a4e7005ec04593b4131843714187b18a95bb381106080848894ce1ac59e5c15c6aa197
- SSDEEP 12288:PYV6MorX7qzuC3QHO9FQVHPF51jgcwNE4fIwfx/nA57lYrCUaP1OyFjsd:cBXu9HGaVHqE4g8nA5CrXazFj0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1364160
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
984KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
345KB
Virtual Size
348KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
465KB
Virtual Size
468KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
out.upx
- SHA256 97c0ba69ba0959ecda8193e99ec0af0a1607ddd4dcefbf1572427f0c8768c49e
- MD5 a43a498c1226f06fb7061f5e8ae714c4
- SHA1 810d1c3eabdc7223762417c3acf14cfa5af28b27
- SHA512 e68fe09994f88e8d5f2e47444f1244b8340158a43cbf9dc54970b2be37df3b51b3ecf666af971a75cf9479e483e6c4ad9876adabc1396109dd51fabf117213c6
- SSDEEP 24576:lAHnh+eWsN3skA4RV1Hom2KXDmmE4g8nA5CrXazFj0:Uh+ZkldoPKzvO8nA5C7azV
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
163850
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
568KB
Virtual Size
567KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
473KB
Virtual Size
472KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,