Swift copy.zip
- SHA256 32da20060ad7e2a649d22526ab5c5ed40ccdf7048a46184c0d6bf487ac4cc313
Behavioral task
behavioral1
Sample
Swift copy.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Swift copy.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target Swift copy.zip
- Size 573KB
- Sample240723-lnrx2ayhjd
- SHA256 32da20060ad7e2a649d22526ab5c5ed40ccdf7048a46184c0d6bf487ac4cc313
- MD5 1c194753feff0330a121db9513d1ac55
- SHA1 e31363c5f060fa33d6854d200e941f55860da450
- SHA512 a1c0f776069a98e07fcb20210cc8de1db21d1cb6dc47d4b37b5fe6bf7bf1db6c0bea86fbdbeaa7831cbfbf631c0b7f010560f4e160f8f7bd93b9964bdff3e4b9
- SSDEEP 12288:P4EMT63cN1qN4HKXFtuZYU4rhLQDnm8Ar5vAKjrIXxfIg8:gT6s3uFtYYXrJam8Al48EXFx8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Swift copy.exe upx - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Swift copy.exe unpack002/out.upx
File Explorer
-
Swift copy.zip.zip 573KB
-
Swift copy.exe.exe 598KB
-
out.upx.exe 1.0MB
Swift copy.exe
- SHA256 a073edb1dacc3f6cbb7b416c6196f7d56a8d6d195a337952524e1e8ee5921461
- MD5 aa175e1bf43f1c940ffd2e23f853a070
- SHA1 bf01a6051d30abac10ba726e7ef40a68c17799f6
- SHA512 65e1295e92dc6bd4bbf68c8769312cc024e84b1264e84b44d31cdec28f484dc9ac8026b42b83ff22848724e65ee57b0c9d777bce3896b84c497a668921e2487f
- SSDEEP 12288:mYV6MorX7qzuC3QHO9FQVHPF51jgc/Ppf5/6KLrA5v5Jg:lBXu9HGaVH5hC6k5Bq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1142864
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
768KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
345KB
Virtual Size
348KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
252KB
Virtual Size
252KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
out.upx
- SHA256 4ab8555bbe50d03a4dfcf45c355fb509413354f7b2ce52f02ded19de12b3350f
- MD5 e1f28cd3edaf996edc77a7dd7257bab6
- SHA1 1ce667755cbe3ba11d6655221103132d98f09aa8
- SHA512 63866188ac15e966c0161bf119abaa0b34be5794cb9ae6030280dd995e1235c6bf2cb57153ed3f68bc719377aa2da8044d43e41f6e85c568be3a5a05e0dc3130
- SSDEEP 24576:3AHnh+eWsN3skA4RV1Hom2KXDmqhC6k5Bq:qh+ZkldoPKzxk5B
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
163850
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
568KB
Virtual Size
567KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
259KB
Virtual Size
259KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,