e44f18c0c7c0ef5103adb70ea9797794.bin
- SHA256 24d8839c73ca7fa9b63855bc144ae94e04327a99be7a6e1ab135d5f22fa39835
Password
infected
Behavioral task
behavioral1
Sample
ce03ff47b601e4154e103927e9b8e9f9f54f18653fe4bebf0a25f6458009dc0d.exe
Resource
win7-20240708-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
ce03ff47b601e4154e103927e9b8e9f9f54f18653fe4bebf0a25f6458009dc0d.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target e44f18c0c7c0ef5103adb70ea9797794.bin
- Size 528KB
- Sample240727-ee82maydng
- SHA256 24d8839c73ca7fa9b63855bc144ae94e04327a99be7a6e1ab135d5f22fa39835
- MD5 a23a844b8dd66bb8629e1aa357aab677
- SHA1 88ac1d58ec2d7a28b52f28424a78a4070b29f9a4
- SHA512 d032e8811f37c2248b8c7f083c3c1a0d0de773dbf9a4c775132579233ab21f706090d252f3d1a2483a9bf966cc0161b3ae2859b90a2431dba313847d129101ed
- SSDEEP 12288:64F/9uEQkf5086qtPDrwkhMUFs/3l6szRXVuD:66/9uJkBT9I3UW3IszRXi
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ce03ff47b601e4154e103927e9b8e9f9f54f18653fe4bebf0a25f6458009dc0d.exe upx - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/ce03ff47b601e4154e103927e9b8e9f9f54f18653fe4bebf0a25f6458009dc0d.exe unpack002/out.upx
File Explorer
-
e44f18c0c7c0ef5103adb70ea9797794.bin.zip 528KB
-
ce03ff47b601e4154e103927e9b8e9f9f54f18653fe4bebf0a25f6458009dc0d.exe.exe 583KB
-
out.upx.exe 1.1MB
ce03ff47b601e4154e103927e9b8e9f9f54f18653fe4bebf0a25f6458009dc0d.exe
- SHA256 ce03ff47b601e4154e103927e9b8e9f9f54f18653fe4bebf0a25f6458009dc0d
- MD5 e44f18c0c7c0ef5103adb70ea9797794
- SHA1 e96882549e5ca1bc3cbedf276a3b0dc2e74b7c1c
- SHA512 3facc779735f5132569dd413191add13333a28d476c9adf3119773af3f6f5a36f1a5a1f768bb2c40c563c10c6574a4556a97755ec36eacb8e5d471341a067277
- SSDEEP 12288:LsHzOUNUSB/o5LsI1uwajJ5yvv1l2WmynaFDoml:6iUmSB/o5d1ubcvnA5oo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
1152736
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
752KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
370KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
212KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
out.upx
- SHA256 a3327935b56526f1d936ecc38c78ada532740c11b82621c50c79a0cdf5d6dbae
- MD5 af7d29b2132d669d38673f31b8df431a
- SHA1 e7d7d00ebf09ed7e02fdaab8bfdd6a373378447d
- SHA512 56961b9b52922e491ea0bb89598237efd4cf457a001ec2c75a47e74c13e4bf8522d3bffd62c931073495e1bc17f1b6148ffbd6e33a0ed9a0ddf547ab4e0e9d06
- SSDEEP 12288:gqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpre4JdxsnaFDoml:gqDEvCTbMWu7rQYlBQcBiT6rp3dR5oo
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
132471
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
619KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
219KB
Virtual Size
219KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,