bounty-56682433713013075
- SHA256 44a52a16fad764bca82c0a2a734a64aa480f3bcd4a5d0bf86ed244ce4912f2fc
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Auto.vbs
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Auto.vbs
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
AutoHotkey.ps1
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
AutoHotkey.ps1
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
AutoHotkey.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
AutoHotkey.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
node.bat
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral8
Sample
node.bat
Resource
win10v2004-20240426-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target bounty-56682433713013075
- Size 955KB
- Sample240610-s2bars1gmb
- SHA256 44a52a16fad764bca82c0a2a734a64aa480f3bcd4a5d0bf86ed244ce4912f2fc
- MD5 aa46ec69af26b16d959a522270a78606
- SHA1 56944ce28138c3728cad583443c155445e773c1b
- SHA512 f5cea1e30631330c4e17befefd36f7c96f1d77b53b6917f2a78e20b2bdb064b27133b11c4f4559446c23818a6516717dbfaff04cbfd03e1f02b8416d3f491e39
- SSDEEP 24576:8hB+OayjynzCw+3pqAVOR0wAs6qQJkV2EPR4JRom:mB+OaCynzCw+5u0wAsz+cZ4JRom
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AutoHotkey.exe
File Explorer
-
bounty-56682433713013075.zip 955KB
-
Auto.vbs.vbs 341B
-
AutoHotkey.ps1 994B
-
AutoHotkey.exe.exe 1.3MB
-
Execute.txt7B
-
Gettype.txt7B
-
Invoke.txt6B
-
NewPE2.txt20B
-
getMethod.txt9B
-
load.txt4B
-
msg.txt804KB
-
node.bat.bat .vbs 687B
-
runpe.txt321KB
Auto.vbs
- SHA256 fa790a55aac779658064f7ce83cee26b84c424e3fe9002ce854d1a142dcb5633
- MD5 1b86ac4c78166fdc657b6ac7c9519761
- SHA1 62c6acb48467dc21d2bccc44b0069690dc65fd4d
- SHA512 482be9eae47c42f7bcbc328bd3f38f476cee5da4ccad5b56133997ce3c0474abc179ecef4dd5a7e60de6177068be19e9fbf7e81895b067e3dd59d3d264c94389
- MD5 SHA1 SHA512
AutoHotkey
- SHA256 7c8a123e9a3afd0df3193b07c32fe68b07409f2ced5db80f5b93125cf5961f08
- MD5 4347a6be90f50fa6d2b840b429a9563b
- SHA1 988e58ea6b12cc4eff037cb4b69ce0824de6081a
- SHA512 76ee9ecfe034f8c77ab0773a4f0a704a35bb043d3038503e4238dd7294730f43e18f28c1653c220895730ce764f1362fea74cf2c5dde3d374dc315cf46c51517
- MD5 SHA1 SHA512
AutoHotkey.exe
- IMPHASH a9b5160326ed68a4bb81944dabab7ed6
- SHA256 effdea83c6b7a1dc2ce9e9d40e91dfd59bed9fcbd580903423648b7ca97d9696
- MD5 2d0600fe2b1b3bdc45d833ca32a37fdb
- SHA1 e9a7411bfef54050de3b485833556f84cabd6e41
- SHA512 9891cd6d2140c3a5c20d5c2d6600f3655df437b99b09ae0f9daf1983190dc73385cc87f02508997bb696ac921eee43fccdf1dc210cc602938807bdb062ce1703
- SSDEEP 24576:a3CTQQje6KWjFUsTNEDcN20pah5nQsrivkdhWeWr2O8hYzlj1TNp4j7YoqK:a3CTQQjxKWjFUsTWDcN20k5nQsrivkdq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
895140
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wsock32
getservbyport
ntohs
inet_addr
htonl
getservbyname
WSASetLastError
htons
WSAGetLastError
gethostbyname
ioctlsocket
gethostbyaddr
gethostname
shutdown
WSACleanup
closesocket
connect
socket
WSAStartup
send
recv
WSAAsyncSelect
inet_ntoa
winmm
waveOutGetVolume
mixerGetLineInfoW
mixerSetControlDetails
mixerGetControlDetailsW
mixerGetLineControlsW
mixerGetDevCapsW
waveOutSetVolume
mixerClose
mixerOpen
mciSendStringW
joyGetDevCapsW
joyGetPosEx
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
comctl32
ImageList_GetIconSize
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
ImageList_ReplaceIcon
CreateStatusWindowW
psapi
GetModuleBaseNameW
GetProcessImageFileNameW
GetModuleFileNameExW
wininet
InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetReadFileExA
InternetOpenW
kernel32
GlobalFree
GlobalUnlock
WideCharToMultiByte
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetEnvironmentVariableW
lstrcmpiW
GetStringTypeExW
CreateThread
SetThreadPriority
GetExitCodeThread
CloseHandle
CreateMutexW
GetLastError
LoadLibraryW
GetModuleHandleW
GetVersionExW
InitializeCriticalSection
DeleteCriticalSection
GetModuleFileNameW
GetFileAttributesW
GetFullPathNameW
GetSystemTimeAsFileTime
LoadResource
LockResource
SizeofResource
GetShortPathNameW
FindFirstFileW
FindNextFileW
FindClose
FileTimeToLocalFileTime
SetEnvironmentVariableW
Beep
MoveFileW
OutputDebugStringW
CreateProcessW
MultiByteToWideChar
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
GetCurrentProcessId
OpenProcess
TerminateProcess
SetPriorityClass
SetLastError
GlobalAlloc
GetDateFormatW
GetTimeFormatW
GetDiskFreeSpaceExW
SetVolumeLabelW
CreateFileW
DeviceIoControl
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceW
GetCurrentDirectoryW
CreateDirectoryW
ReadFile
WriteFile
DeleteFileW
CopyFileW
SetFileAttributesW
LocalFileTimeToFileTime
SetFileTime
GetFileSizeEx
GetSystemTime
GetSystemDefaultUILanguage
GetComputerNameW
GetSystemWindowsDirectoryW
GetTempPathW
EnterCriticalSection
LeaveCriticalSection
VirtualProtect
QueryDosDeviceW
CompareStringW
RemoveDirectoryW
GetCurrentProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FormatMessageW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
WritePrivateProfileSectionW
SetEndOfFile
GetACP
GetFileType
GetStdHandle
SetFilePointerEx
SystemTimeToFileTime
FileTimeToSystemTime
GetFileSize
IsWow64Process
VirtualAllocEx
VirtualFreeEx
EnumResourceNamesW
LoadLibraryExW
GlobalSize
GlobalLock
FindResourceW
SetErrorMode
GetCPInfo
SetCurrentDirectoryW
Sleep
GetTickCount
MulDiv
EncodePointer
HeapSize
HeapQueryInformation
GetCommandLineW
GetStartupInfoW
GetOEMCP
IsValidCodePage
FlsGetValue
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
DecodePointer
FlsSetValue
FlsFree
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
HeapSetInformation
GetVersion
HeapCreate
InitializeCriticalSectionAndSpinCount
RtlUnwindEx
RaiseException
RtlPcToFileHeader
LCMapStringW
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
SetFilePointer
WriteConsoleW
SetStdHandle
FlushFileBuffers
GetLocalTime
GetProcessHeap
user32
SetWindowPos
SetLayeredWindowAttributes
InvalidateRect
EnableWindow
GetWindowTextLengthW
EnumWindows
IsZoomed
IsIconic
EnumDisplayMonitors
RegisterWindowMessageW
GetSysColor
GetSysColorBrush
DrawIconEx
FillRect
DefWindowProcW
SetForegroundWindow
DialogBoxParamW
SendDlgItemMessageW
GetDlgItem
SetDlgItemTextW
MessageBeep
GetCursorInfo
GetLastInputInfo
GetSystemMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuStringW
ExitWindowsEx
SetMenu
FlashWindow
GetPropW
SetPropW
RemovePropW
MapWindowPoints
RedrawWindow
SetWindowLongPtrW
SetParent
GetClassInfoExW
DefDlgProcW
GetAncestor
UpdateWindow
GetMessagePos
GetClassLongPtrW
CallWindowProcW
CheckRadioButton
IntersectRect
GetUpdateRect
PtInRect
CreateDialogIndirectParamW
GetWindowLongPtrW
CreateAcceleratorTableW
DestroyAcceleratorTable
InsertMenuItemW
SetMenuDefaultItem
RemoveMenu
SetMenuItemInfoW
IsMenu
GetMenuItemInfoW
CreateMenu
CreatePopupMenu
SetMenuInfo
AppendMenuW
DestroyMenu
TrackPopupMenuEx
CopyImage
SetWindowRgn
CreateIconFromResourceEx
EnumClipboardFormats
GetWindow
BringWindowToTop
GetTopWindow
GetQueueStatus
CheckMenuItem
PostQuitMessage
GetIconInfo
ChangeClipboardChain
SetClipboardViewer
LoadAcceleratorsW
EnableMenuItem
GetMenu
CreateWindowExW
RegisterClassExW
LoadCursorW
DestroyIcon
DestroyWindow
IsCharAlphaW
MapVirtualKeyW
VkKeyScanExW
MapVirtualKeyExW
GetKeyboardLayoutNameW
ActivateKeyboardLayout
GetGUIThreadInfo
GetWindowTextW
mouse_event
WindowFromPoint
GetSystemMetrics
keybd_event
SetKeyboardState
GetKeyboardState
GetCursorPos
GetAsyncKeyState
AttachThreadInput
UnregisterHotKey
RegisterHotKey
SendMessageTimeoutW
UnhookWindowsHookEx
SetWindowsHookExW
PostThreadMessageW
IsCharAlphaNumericW
IsCharUpperW
IsCharLowerW
ToUnicodeEx
GetKeyboardLayout
CallNextHookEx
CharLowerW
ReleaseDC
GetDC
MessageBoxW
OpenClipboard
GetClipboardData
GetClipboardFormatNameW
CloseClipboard
SetClipboardData
EmptyClipboard
PostMessageW
FindWindowW
EndDialog
IsWindow
DispatchMessageW
TranslateMessage
ShowWindow
SetFocus
SetActiveWindow
ClientToScreen
EnumChildWindows
MoveWindow
GetWindowRect
GetMonitorInfoW
MonitorFromPoint
GetClientRect
SystemParametersInfoW
AdjustWindowRectEx
DrawTextW
CreateIconIndirect
SetRect
CountClipboardFormats
SetWindowLongW
ScreenToClient
IsDialogMessageW
SendMessageW
IsWindowEnabled
GetWindowLongW
GetKeyState
TranslateAcceleratorW
KillTimer
PeekMessageW
GetFocus
GetClassNameW
GetWindowThreadProcessId
GetForegroundWindow
GetMessageW
SetTimer
GetParent
GetDlgCtrlID
CharUpperW
IsClipboardFormatAvailable
SetWindowTextW
IsWindowVisible
LoadImageW
BlockInput
SendInput
gdi32
GdiFlush
CreateDIBSection
EnumFontFamiliesExW
SetBrushOrgEx
SetBkColor
GetPixel
BitBlt
CreatePatternBrush
SetBkMode
GetCharABCWidthsW
GetClipBox
FillRgn
GetClipRgn
ExcludeClipRect
GetDeviceCaps
DeleteObject
CreateFontW
CreateSolidBrush
CreateDCW
CreateCompatibleBitmap
GetSystemPaletteEntries
GetDIBits
CreateCompatibleDC
CreatePolygonRgn
CreateRectRgn
CreateRoundRectRgn
CreateEllipticRgn
DeleteDC
GetObjectW
GetTextMetricsW
GetTextFaceW
SelectObject
GetStockObject
SetTextColor
comdlg32
CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW
advapi32
GetUserNameW
LockServiceDatabase
OpenSCManagerW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CloseServiceHandle
RegConnectRegistryW
UnlockServiceDatabase
shell32
DragQueryPoint
SHEmptyRecycleBinW
SHFileOperationW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetDesktopFolder
SHGetMalloc
SHGetFolderPathW
ShellExecuteExW
Shell_NotifyIconW
DragFinish
DragQueryFileW
ExtractIconW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
CoInitialize
CoUninitialize
CLSIDFromString
CLSIDFromProgID
CoGetObject
StringFromGUID2
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
SafeArrayUnaccessData
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnlock
SafeArrayDestroy
GetActiveObject
SysStringLen
SysFreeString
SafeArrayCreate
VariantClear
VariantChangeType
SysAllocString
SafeArrayCopy
VariantCopyInd
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayLock
SafeArrayPtrOfIndex
Name
.text
Size
948KB
Virtual Size
947KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
210KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
Name
data
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=152, version=20115,
count=54, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=151, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=135, version=30729,
count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=486, id=1, productName=Unmarked objects,
count=23, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=43, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Execute.txt
- SHA256 0bfa2b7d3d1a1a671c126dc0aa12a7e3a28e5d3b54ab668783e08cafedafbc3a
- MD5 720d2a3ed7e16367c31bbca2a6c5c924
- SHA1 9c58ec9c24bea197af824d0b78678d7188a348c7
- SHA512 0f694d314315eeb5e3d5d8f21619537cd7723203274c98730937c1a02498ca4e4b6d6dce7d25003c3f7a4725995c96cc12e3daffbab20b10de788dd4d330b622
- MD5 SHA1 SHA512
Gettype.txt
- SHA256 8eab5c7c6d1116d28014f0da7b7e78b9857da1e6f951b903f2a714fc6d3c790a
- MD5 9221b7b54ed96de7281d31f8ae35be6a
- SHA1 223fad426aa8c753546501b0643ee1720b57bff0
- SHA512 be37de186628a2c30698a6d4826ec5f8845e7b69317b2f044e86fae615c263a5fd179fcbc50821c85b49c9e3e71adb10a947060312da281418c8ca231d656d5d
- MD5 SHA1 SHA512
Invoke.txt
- SHA256 e77f5b9f691679ef6fa67d3ec953199b1696cf6a0e77741c035f11aadfd9bf73
- MD5 5fb833d20ef9f93596f4117a81523536
- SHA1 d6aa1f3a789f3f3108666e0ac807ca5ca7dc5fa5
- SHA512 afaec35da2440502779227d9436570db82e1f5d86c90662eae82564d717407518d4e1181e024566e2d8d6029bd4e738b9ba4a3108753a8d0d0c98934db94ba35
- MD5 SHA1 SHA512
NewPE2.txt
- SHA256 ceebdf25f96dda93a3a2117d59ac847823b591abbebadcbb36182b50ab625c70
- MD5 6aa09883f5176f1b1696b2a27d89146a
- SHA1 b258abd44ce2f9281802a6f51d5fe283aaaab74a
- SHA512 7c08f8135817962d4ec5b3e0d88371807f88dea037cf46b7187957d55d6e7b0fadc57c1f14b8b07c33b126655bbabe8b9f3f21ff6914737c105a91381fecdb9d
- MD5 SHA1 SHA512
getMethod.txt
- SHA256 e53ba77fa1dbcb1cc3beed1344f6ae7b182d6a2e2a09bb32ec0d4474978e4a32
- MD5 db37f91f128a82062af0f39f649ea122
- SHA1 f21110ae7ac7cde74e7aa59b22ed10bace35b06b
- SHA512 681c5c69acba8c2b327afd0bcb1062fb5f6ee3231e6b95f4cd97ecd768879250eb81d36b1e1640554a85002a7b2b099acfe7f59f70884f10afd51d372583d3ae
- MD5 SHA1 SHA512
load.txt
- SHA256 0cf67fc72b3c86c7a454f6d86b43ed245a8e491d0e5288d4da8c7ff43a7bcdb0
- MD5 ec4d1eb36b22d19728e9d1d23ca84d1c
- SHA1 5dbc716c4600097b85b9e51d6aeb77a4363b03ed
- SHA512 d67f0ffb682d7a13510ec5d3e643889d43bc7593429f806fd882b2c72c05a530c2462d332d4293015f33397cdec84c53d1eea58a7bebaab5504153729df02700
- MD5 SHA1 SHA512
msg.txt
- SHA256 51cc0c4c2e980f349528c4f3be519b12d01adf4d9033b4a75e4a543baf9f0856
- MD5 9107feddbc16e98a626d1f8cd33d2f5d
- SHA1 b55168be5d856334867bf57828f563813fc63805
- SHA512 2dccefcc9559b806edb352807edf38dd513b861f4ef7e29cc5c1f826efe7a8dd6ba8e98a99ccbb127ec0b6fb7b906406641b972d96a555693965d70839f2c376
- SSDEEP 12288:D4WeSwfkkOZBRIanWTSk7VQ0AkOEs3cqArz9G3j6ZA/6kullHPVq+lQ4c0qtxCiT:LAtS6VM
- MD5 SHA1 SHA512 SSDEEP
node.bat
- SHA256 b99b7a8864e07ed15ba3e11ec6e5ad793d3a8e257321c89c7c2b7842cc674728
- MD5 52dc8ab7250ca32c7dea8867d6464e5b
- SHA1 4e3202f42632fa8a2c1c632af80b8223b9ada385
- SHA512 f43a7fc7e9d57f46eb08a8d84dde6503b5fd65c1f2e4a28f80ca700ca2050506c05b09ad52e092c6b46f094a079580bbd863cf04ff0ea3db589d2527218ef985
- MD5 SHA1 SHA512
runpe.txt
- SHA256 6b54452e750818739847993e973e8c4cc9ab42fd2ebbe5c919228e34043554c1
- MD5 7044d392ceb5669de318f1deb11cfd66
- SHA1 c9ddff7f4d14b3c9e3b55673da885fb5951944e8
- SHA512 aff117f62f4f16ee5679e725caff28ebabffb2c24cdd248b13245bb7c55f25da7494b7e41ad3bd01dde59c55f0d52211dfbe0c77c1db5167a78649937c6a7dcb
- SSDEEP 6144:xLis+qJ5r8jowko2mS7Hov32GVyLS8G8I2OzA1yOy+zalL+0gF5Eqj9GIYDHYsYE:3VMjFko2jovmGVyLS8G8I2Os1yOJzalj
- MD5 SHA1 SHA512 SSDEEP