24072024_0152_23072024_Ticket Receipt and Fine[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
24072024_0152_23072024_Ticket Receipt and Fine.rar
Size 1.1MB
Sample240724-cahb1avbmd
SHA256 eefb26bbeb513ba2ea7052b816f46272dee65d1355b8c834d6a526941509b008
MD5 e29dfe1b775f54eef32440c15941b1a8
SHA1 68059cfb57ecf3268bc2a10680f6be209bbc20e2
SHA512 28a2a931777a42929f3266b72eafaeff581e3795ea8ed84762e746794fb7e5afa696971422b4957a8c4fee5e720d8540da4c4d62a0f045c46c1d4024922fe6de
SSDEEP 24576:Dlpb9o3iSrI2cLIZNHI/Dslpb9o3iSrI2cLIZNHI/DN:3b9kiY55b9kiY5a
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack002/Abu Dhabi Police Offenders Publishing Images WSAbuDhabi.exe	autoit_exe
static1/unpack004/Receipt-30927862-Ticket#0973726-Fines-19346383.exe	autoit_exe

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Abu Dhabi Police Offenders Publishing Images WSAbuDhabi.exe
unpack004/Receipt-30927862-Ticket#0973726-Fines-19346383.exe

File Explorer

24072024_0152_23072024_Ticket Receipt and Fine.rar

.rar 1.1MB
Abu Dhabi Police Offenders Publishing Images WSAbuDhabi.rar

.rar 557KB
Abu Dhabi Police Offenders Publishing Images WSAbuDhabi.exe

.exe 1.0MB
Receipt-30927862-Ticket#0973726-Fines-19346383.rar

.rar 557KB
Receipt-30927862-Ticket#0973726-Fines-19346383.exe

.exe 1.0MB

24072024_0152_23072024_Ticket Receipt and Fine.rar

SHA256 eefb26bbeb513ba2ea7052b816f46272dee65d1355b8c834d6a526941509b008
MD5 e29dfe1b775f54eef32440c15941b1a8
SHA1 68059cfb57ecf3268bc2a10680f6be209bbc20e2
SHA512 28a2a931777a42929f3266b72eafaeff581e3795ea8ed84762e746794fb7e5afa696971422b4957a8c4fee5e720d8540da4c4d62a0f045c46c1d4024922fe6de
SSDEEP 24576:Dlpb9o3iSrI2cLIZNHI/Dslpb9o3iSrI2cLIZNHI/DN:3b9kiY55b9kiY5a
MD5 SHA1 SHA512 SSDEEP

Password

infected

Abu Dhabi Police Offenders Publishing Images WSAbuDhabi.exe

IMPHASH 7f2222d75bcebeb591b7d884c5b9299b
SHA256 a8a7abb66cf22c7f804029fa215b1dd39861eda91874af97436a4ac738670f99
MD5 d8b35495d596fa9369df3a9e5d95da70
SHA1 1791b053bf9b9eaeaa7f8ce2e21558a281292ab3
SHA512 ad620640b076a72ec497b5bdea5180d520f666bed091148cfc342525b34671fb30b2339cc6f4abd4ff9d1f7e30c0f1976126f3e498af95a9115016eebd0b70a0
SSDEEP 24576:btb20pkaCqT5TBWgNQ7akdu8ScxJtJM2nt6A:YVg5tQ7akdugrfM2t5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

155508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

__WSAFDIsSet recv send setsockopt ntohs recvfrom select WSAStartup htons accept listen bind closesocket connect WSACleanup ioctlsocket sendto WSAGetLastError inet_addr gethostbyname gethostname socket

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_Destroy ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove ImageList_Create InitCommonControlsEx ImageList_ReplaceIcon

mpr

WNetUseConnectionW WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetQueryOptionW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetConnectW InternetQueryDataAvailable

psapi

GetProcessMemoryInfo

iphlpapi

IcmpCreateFile IcmpCloseHandle IcmpSendEcho

userenv

UnloadUserProfile DestroyEnvironmentBlock CreateEnvironmentBlock LoadUserProfileW

uxtheme

IsThemeActive

kernel32

HeapAlloc GetProcessHeap HeapFree Sleep GetCurrentThreadId MultiByteToWideChar MulDiv GetVersionExW GetSystemInfo FreeLibrary LoadLibraryA GetProcAddress SetErrorMode GetModuleFileNameW WideCharToMultiByte lstrcpyW lstrlenW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW FindClose GetLongPathNameW GetCurrentThread FindNextFileW MoveFileW CopyFileW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource EnumResourceNamesW OutputDebugStringW GetTempPathW GetTempFileNameW DeviceIoControl GetLocalTime CompareStringW DeleteCriticalSection WaitForSingleObject LeaveCriticalSection GetStdHandle CreatePipe InterlockedExchange TerminateThread LoadLibraryExW FindResourceExW VirtualFree FormatMessageW GetExitCodeProcess GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW SetFileAttributesW GetShortPathNameW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetProcessIoCounters CreateProcessW SetPriorityClass LoadLibraryW VirtualAlloc CloseHandle GetLastError GetFullPathNameW SetCurrentDirectoryW IsDebuggerPresent GetCurrentDirectoryW lstrcmpiW RaiseException InitializeCriticalSectionAndSpinCount InterlockedDecrement InterlockedIncrement CreateThread DuplicateHandle EnterCriticalSection GetCurrentProcess ExitProcess GetModuleHandleExW ExitThread GetSystemTimeAsFileTime ResumeThread GetCommandLineW IsProcessorFeaturePresent HeapSize IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetStringTypeW SetStdHandle GetFileType GetConsoleCP GetConsoleMode RtlUnwind ReadConsoleW SetFilePointer GetTimeZoneInformation GetDateFormatW GetTimeFormatW LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc WriteConsoleW SetEndOfFile DeleteFileW SetEnvironmentVariableA

user32

SetWindowPos GetCursorInfo RegisterHotKey ClientToScreen GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics DrawMenuBar GetActiveWindow CharNextW wsprintfW RedrawWindow DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW CallWindowProcW ReleaseCapture SetCapture MonitorFromRect LoadImageW CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu TrackPopupMenuEx GetCursorPos CopyImage CheckMenuRadioItem GetMenuItemID GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic FindWindowW UnregisterHotKey keybd_event SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowLongW GetWindowThreadProcessId AttachThreadInput GetFocus ScreenToClient SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation OpenWindowStationW GetUserObjectSecurity AdjustWindowRectEx SetRect SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard BlockInput GetMessageW LockWindowUpdate DispatchMessageW TranslateMessage DeleteMenu PeekMessageW MessageBoxW DefWindowProcW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon SystemParametersInfoW CharLowerBuffW GetWindowTextW

gdi32

SetPixel DeleteObject GetTextExtentPoint32W ExtCreatePen StrokeAndFillPath StrokePath GetDeviceCaps CloseFigure LineTo AngleArc CreateCompatibleBitmap CreateCompatibleDC MoveToEx Ellipse PolyDraw BeginPath SelectObject StretchBlt GetDIBits DeleteDC GetPixel CreateDCW GetStockObject Rectangle SetViewportOrgEx GetObjectW SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush SetTextColor CreateFontW GetTextFaceW EndPath

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

GetAclInformation RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegCreateKeyExW GetUserNameW RegOpenKeyExW RegCloseKey RegQueryValueExW RegConnectRegistryW InitializeSecurityDescriptor InitializeAcl AdjustTokenPrivileges OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW GetLengthSid CopySid InitiateSystemShutdownExW LogonUserW AllocateAndInitializeSid CheckTokenMembership FreeSid GetTokenInformation GetSecurityDescriptorDacl SetSecurityDescriptorDacl AddAce GetAce

shell32

DragQueryPoint ShellExecuteExW DragQueryFileW SHEmptyRecycleBinW SHGetPathFromIDListW SHBrowseForFolderW SHCreateShellItem SHGetDesktopFolder SHGetSpecialFolderLocation SHGetFolderPathW SHFileOperationW ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

CoTaskMemAlloc CoTaskMemFree CLSIDFromString ProgIDFromCLSID CLSIDFromProgID OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoCreateInstance IIDFromString StringFromGUID2 CreateStreamOnHGlobal CoInitialize CoUninitialize GetRunningObjectTable CoGetInstanceFromFile CoGetObject CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket

oleaut32

RegisterTypeLi LoadTypeLibEx VariantCopyInd SysReAllocString SysFreeString SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnaccessData SafeArrayAccessData SafeArrayAllocData UnRegisterTypeLi SafeArrayCreateVector SysAllocString SysStringLen VariantTimeToSystemTime VarR8FromDec SafeArrayGetVartype OleLoadPicture QueryPathOfRegTypeLi VariantCopy VariantClear CreateDispTypeInfo CreateStdDispatch DispCallFunc VariantChangeType SafeArrayAllocDescriptorEx VariantInit

Receipt-30927862-Ticket#0973726-Fines-19346383.exe

IMPHASH 7f2222d75bcebeb591b7d884c5b9299b
SHA256 a8a7abb66cf22c7f804029fa215b1dd39861eda91874af97436a4ac738670f99
MD5 d8b35495d596fa9369df3a9e5d95da70
SHA1 1791b053bf9b9eaeaa7f8ce2e21558a281292ab3
SHA512 ad620640b076a72ec497b5bdea5180d520f666bed091148cfc342525b34671fb30b2339cc6f4abd4ff9d1f7e30c0f1976126f3e498af95a9115016eebd0b70a0
SSDEEP 24576:btb20pkaCqT5TBWgNQ7akdu8ScxJtJM2nt6A:YVg5tQ7akdugrfM2t5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

155508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

mpr

WNetUseConnectionW WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W

wininet

psapi

GetProcessMemoryInfo

iphlpapi

IcmpCreateFile IcmpCloseHandle IcmpSendEcho

userenv

UnloadUserProfile DestroyEnvironmentBlock CreateEnvironmentBlock LoadUserProfileW

Sharing

General

Malware Config

Signatures

File Explorer

24072024_0152_23072024_Ticket Receipt and Fine.rar

Abu Dhabi Police Offenders Publishing Images WSAbuDhabi.rar

Abu Dhabi Police Offenders Publishing Images WSAbuDhabi.exe

wsock32

version

winmm

comctl32

mpr

wininet

psapi

iphlpapi

userenv

uxtheme

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic

Receipt-30927862-Ticket#0973726-Fines-19346383.rar

Receipt-30927862-Ticket#0973726-Fines-19346383.exe

wsock32

version

winmm

comctl32

mpr

wininet

psapi

iphlpapi

userenv

uxtheme

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic