auxia_updater.rar
- SHA256 399b296b21cca504e716f53dddc8d01ab781b4592306320cb8b80ddcdfda333d
Behavioral task
behavioral1
Sample
auxia_updater.exe
Resource
win7-20240705-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
auxia_updater.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
33 signatures
150 seconds
General
- Target auxia_updater.rar
- Size 10.7MB
- Sample240803-dv2f2swepf
- SHA256 399b296b21cca504e716f53dddc8d01ab781b4592306320cb8b80ddcdfda333d
- MD5 15806c88e2569cf2bfaa664fd5a860c1
- SHA1 6cfbf0bdab370cd35c8aeba32be0ad3e121e668c
- SHA512 063bdee42547d531cda35efc46434c3c2bcf77f850a9284f38703e034732ea2dae6a9b24b92fc2018846637e8872dbd38bfdfd0a5658b2029e0e2f1398701b5d
- SSDEEP 196608:96+INFAuQjoKxhO7scD3wj9LfFYk2X4Pq7sx4DORbpjI0XDEccC+/IaruOJKarbH:UjiuOoKxI7sRJLaZX4PasMO7jDEdRIah
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/auxia_updater.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/auxia_updater.exe
File Explorer
-
auxia_updater.rar.rar 10.7MB
-
auxia_updater.exe.exe 10.9MB
-
Stub.pyc178KB
auxia_updater.exe
- IMPHASH 456e8615ad4320c9f54e50319a19df9c
- SHA256 92f7de4db70a88abef1e2fb31174fffa5a1b885aab68012b8a4ac31b3e827e22
- MD5 3b83f4ed82c3f00ccfd267a3fa0ff65e
- SHA1 abb3b29c7092e0fec2d29999b56718b2267ed2c7
- SHA512 606c5238e11dfb41729fd510bf730dce67de5cf3f6a4f611b85ab555e71752c3df82890da075b5b14a8a2da8ca18781da8d468b9d3b1b44ab439e57eb45eee20
- SSDEEP 196608:G7tPRQkdwuLUhJb3tQk5tsurErvI9pWj+sgX3ZdahF0wB1AajVsCEk9QtQTNWVJg:SxOhh7v5tsurEUWj/gXe7b2C7S6gU
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
49360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
GetLastError
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
WaitForSingleObject
Sleep
GetCurrentProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
IsProcessorFeaturePresent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
165KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=180, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=33731,
count=9, id=259, version=33731,
count=17, id=260, version=33731,
count=40, id=261, version=33731,
count=11, id=257, version=30795,
count=145, id=1, productName=Unmarked objects,
count=25, id=260, version=33811,
count=1, id=258, version=33811,
Stub.pyc
- SHA256 0dbff9c19efe825382a31a93808cc9e6ed55c7112788d908e45dd9e382618f18
- MD5 03c51d5d2690c613e085153d7cca80a2
- SHA1 b955fb0d42ea8f445ad6fb2395bf8480e028693a
- SHA512 431f9bbacab31d405613c740edf147f5c7fdd8ce574e1a3b23787c3a3b5913694313d7a94396b16599f7f81c1675a58f2d968eac39fa2313d3189771caefb584
- SSDEEP 3072:iPGcc87YoHEj0SsnjCuGUvO92ebnxVZ7uuG6ZX9cvVaNqSgmZ/3MJ1yBx/S0+E:iPGQ7jcvJ92eb1cvVyd3Yy+E
- MD5 SHA1 SHA512 SSDEEP