179f6de358cb9094fd7fc1172aa5c639.bin
- SHA256 b62ba3edee28e4932787e0058c2644c5ec536f038c5f85eb3d47779d92bcf2d1
Password
infected
Behavioral task
behavioral1
Sample
4445da3b40d99dac698784083e9ce281d09e307b00dbca4bf103a66ee55635ed.exe
Resource
win7-20240611-en
windows7-x64
10 signatures
150 seconds
General
- Target 179f6de358cb9094fd7fc1172aa5c639.bin
- Size 643KB
- Sample240615-bhc7kstdmd
- SHA256 b62ba3edee28e4932787e0058c2644c5ec536f038c5f85eb3d47779d92bcf2d1
- MD5 e40faed22115a0bcdb4290b6c59ebef4
- SHA1 1a0fbc393988121f97d7f6280e9007356068ba2a
- SHA512 fdeb7c0cc3d5cfb4fec14caea59dcf94e38eaba5e46513902112343ddf02d941f84752d0d001a5eec702c9d65790dc8ee284e94042d68195199696485a7b77d1
- SSDEEP 12288:RmwdUJRzHTu3cSlDjfb2ebgB+BRHrAgTZcWpXWb478HLZ03uaN:HdOtTu3cSFfaebgY/LAgTxh25aN
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/4445da3b40d99dac698784083e9ce281d09e307b00dbca4bf103a66ee55635ed.exe upx - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/4445da3b40d99dac698784083e9ce281d09e307b00dbca4bf103a66ee55635ed.exe unpack002/out.upx
File Explorer
-
179f6de358cb9094fd7fc1172aa5c639.bin.zip 643KB
-
4445da3b40d99dac698784083e9ce281d09e307b00dbca4bf103a66ee55635ed.exe.exe 668KB
-
out.upx.exe 1.1MB
4445da3b40d99dac698784083e9ce281d09e307b00dbca4bf103a66ee55635ed.exe
- SHA256 4445da3b40d99dac698784083e9ce281d09e307b00dbca4bf103a66ee55635ed
- MD5 179f6de358cb9094fd7fc1172aa5c639
- SHA1 b44b91e0b154ba650b0a1411c6f551c0a47e9989
- SHA512 86dbb3122b2db5729a4d44cb9cf66ffd41c75b8d6a25109a50dc0c3ae1803efff1d8621fd6c89fa9074eb67c0327e89efb4f18072e17ce73747cd54a84f5c54b
- SSDEEP 12288:IYV6MorX7qzuC3QHO9FQVHPF51jgcAaG8LuMVnVHIRE4YDloN7Eu/:nBXu9HGaVHAzTfRE4YGN71/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
1216656
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
840KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
345KB
Virtual Size
348KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
322KB
Virtual Size
324KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
out.upx
- SHA256 8406c61d92c0ef9a23d7c17fb92bb14ef8e9e71a274c2f02c61642e11d05b505
- MD5 a01e73e8eb603f181e33d920019fce88
- SHA1 c9ba1ec979d5912ba02dc4d932572565bf428068
- SHA512 5c1ec722820bc502f77e00be4556e53c3a735ca4add623729bf42ae8964e35cc49dd32d7ac96451c62000b1a879bd1f206982aebcdca0c2c79514fc595b6ece6
- SSDEEP 24576:dAHnh+eWsN3skA4RV1Hom2KXDmQTfRE4YGN71/:8h+ZkldoPKz9G0N71
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
163850
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
568KB
Virtual Size
567KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
330KB
Virtual Size
329KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,