Behavioral task
behavioral1
Sample
ce03ff47b601e4154e103927e9b8e9f9f54f18653fe4bebf0a25f6458009dc0d.exe
Resource
win7-20240708-en
General
-
Target
24d8839c73ca7fa9b63855bc144ae94e04327a99be7a6e1ab135d5f22fa39835
-
Size
528KB
-
MD5
a23a844b8dd66bb8629e1aa357aab677
-
SHA1
88ac1d58ec2d7a28b52f28424a78a4070b29f9a4
-
SHA256
24d8839c73ca7fa9b63855bc144ae94e04327a99be7a6e1ab135d5f22fa39835
-
SHA512
d032e8811f37c2248b8c7f083c3c1a0d0de773dbf9a4c775132579233ab21f706090d252f3d1a2483a9bf966cc0161b3ae2859b90a2431dba313847d129101ed
-
SSDEEP
12288:64F/9uEQkf5086qtPDrwkhMUFs/3l6szRXVuD:66/9uJkBT9I3UW3IszRXi
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ce03ff47b601e4154e103927e9b8e9f9f54f18653fe4bebf0a25f6458009dc0d.exe upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/ce03ff47b601e4154e103927e9b8e9f9f54f18653fe4bebf0a25f6458009dc0d.exe unpack002/out.upx
Files
-
24d8839c73ca7fa9b63855bc144ae94e04327a99be7a6e1ab135d5f22fa39835.zip
Password: infected
-
ce03ff47b601e4154e103927e9b8e9f9f54f18653fe4bebf0a25f6458009dc0d.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 752KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 370KB - Virtual size: 372KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 212KB - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 619KB - Virtual size: 618KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 191KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 219KB - Virtual size: 219KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ