Behavioral task
behavioral1
Sample
abb36a7e89666d599cdc7f2877759e988acca4fe79bf3af3ed913b983f993c26.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
abb36a7e89666d599cdc7f2877759e988acca4fe79bf3af3ed913b983f993c26.exe
Resource
win10v2004-20240704-en
General
-
Target
abb36a7e89666d599cdc7f2877759e988acca4fe79bf3af3ed913b983f993c26
-
Size
643KB
-
MD5
85979787b5e2b1b001ae0548d2f41d44
-
SHA1
0f9d1d8aa480ff93dc1c92a10e5ecefcd69314ee
-
SHA256
abb36a7e89666d599cdc7f2877759e988acca4fe79bf3af3ed913b983f993c26
-
SHA512
60da119f0b504fca2ea3532b5250d9b4c79b8a63c115a188f722dc90156136e81ecdb665844529d23f96b91b01181016e4d4069d63e8f8d1a044a9f7d1059b96
-
SSDEEP
12288:fYV6MorX7qzuC3QHO9FQVHPF51jgc/1UNaS/n0KzMKtBKALyHN5L2Ew/WjEFKU2:sBXu9HGaVH/G7z76nT2rW2KU2
Malware Config
Signatures
-
resource yara_rule sample upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource abb36a7e89666d599cdc7f2877759e988acca4fe79bf3af3ed913b983f993c26 unpack001/out.upx
Files
-
abb36a7e89666d599cdc7f2877759e988acca4fe79bf3af3ed913b983f993c26.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 816KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 345KB - Virtual size: 348KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 297KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 568KB - Virtual size: 567KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 191KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 305KB - Virtual size: 305KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ