50038e172e33e7fdfca6287221ffe1a4.bin
- SHA256 5bebe54b9b41172af2e5f7c1bf21ebb5e46b23598eb6a01d3d97abca57b89fc2
Password
infected
Behavioral task
behavioral1
Sample
185989caa5645c696d2d92dcbb9c400c6270b2d4cf21b87ac718144a1e0486e1.exe
Resource
win7-20240220-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
185989caa5645c696d2d92dcbb9c400c6270b2d4cf21b87ac718144a1e0486e1.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 50038e172e33e7fdfca6287221ffe1a4.bin
- Size 706KB
- Sample240614-b75m5avarp
- SHA256 5bebe54b9b41172af2e5f7c1bf21ebb5e46b23598eb6a01d3d97abca57b89fc2
- MD5 d0079f2b7958690b5b114ca12c2cfdfe
- SHA1 d3711ce0d26c61ba43700fc41dbcb57b7c26622f
- SHA512 1f3954f69fa210a4cd8990b21983f5dc7c1440658203c8aac777c9f6b3e1fdbb278c32754d5b9c805ced5534f07c8784618c84b32a72a1f5b95d05d8f7eadcde
- SSDEEP 12288:qUPjjD+CZ073dacvVr90CynP3Qx4JDqwDwe/jLpc46dyhsCgQX8AEhDJyZkOxP9z:Uz7takzynfs4JD1DwEh6vHQMbqTF
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/185989caa5645c696d2d92dcbb9c400c6270b2d4cf21b87ac718144a1e0486e1.exe upx - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/185989caa5645c696d2d92dcbb9c400c6270b2d4cf21b87ac718144a1e0486e1.exe unpack002/out.upx
File Explorer
-
50038e172e33e7fdfca6287221ffe1a4.bin.zip 706KB
-
185989caa5645c696d2d92dcbb9c400c6270b2d4cf21b87ac718144a1e0486e1.exe.exe 808KB
-
out.upx.exe 1.2MB
185989caa5645c696d2d92dcbb9c400c6270b2d4cf21b87ac718144a1e0486e1.exe
- SHA256 185989caa5645c696d2d92dcbb9c400c6270b2d4cf21b87ac718144a1e0486e1
- MD5 50038e172e33e7fdfca6287221ffe1a4
- SHA1 5f9fbe3b245b776c2553382c35cd1595dd7180b7
- SHA512 af9e4191426fab2df181d80084d76927e0632a8031b0fec7bc7d0e2b51cf1df341c4f6eb112a641f4410de92c84cabd1686bf51bfa6ecbb18e1ed2d5ade34f64
- SSDEEP 12288:SYV6MorX7qzuC3QHO9FQVHPF51jgcP7ZF968JT4/UXuWJeYAijFd6Ll:hBXu9HGaVHTZq/UdJ9z6Ll
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
1360080
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
980KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
345KB
Virtual Size
348KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
462KB
Virtual Size
464KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
out.upx
- SHA256 9eed4818d31b3b516607648f2509677d178cce8ce75ac901cb461e8a9dfeeca6
- MD5 7a1f8716a32508bdc0f8c42a97ef490f
- SHA1 8c6f6939df955b25e0dcbea069fdd23a44f41c56
- SHA512 4a86d4066a1f458951c093a47dcf1f6937c1dc4b1339f64ce0220cb9b52d028ee398ce1f869ed8a5cda35ebc11bd388b582b64f420996cb2f0185a9b8f2ae5f7
- SSDEEP 24576:yAHnh+eWsN3skA4RV1Hom2KXDm2/UdJ9z6Ll:1h+ZkldoPKznUdJ9z
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
163850
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
568KB
Virtual Size
567KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
470KB
Virtual Size
469KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,