07082024_0840_06082024_inquiry for AP-103- FM-2400 project[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
07082024_0840_06082024_inquiry for AP-103- FM-2400 project.rar
Size 819KB
Sample240807-kk55tayfnc
SHA256 c3b40aa0812f285a67bcf3f113f90c6aa3b4e6ace44ddc6fb7431291876f45f2
MD5 6ef854a9770861006e94d30f49fe63dd
SHA1 b27d7958f0b9bee172aee7cad0381e0dbf42b4ff
SHA512 b84f914ea095a16e54e3faa326e9aa888cdb70ca3d2f1d5bca23a40b78fa73d393c04ed65540a553ed9fc06991caaeb201ae28052b69ba005007ec60bcf03f47
SSDEEP 12288:Tbumyi0FeWtkvS+0lguViZZiyKWHysgOE/s3ntdY0LrhnGnc7FMVD6la6GKwrbD:Tu7bhblXoyWHysdEq20vhnvouD8D
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/inquiry for AP-103- FM-2400 project.exe	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/inquiry for AP-103- FM-2400 project.exe

File Explorer

07082024_0840_06082024_inquiry for AP-103- FM-2400 project.rar

.rar 819KB
drawing parts No. KMS(TPO)24002.pdf

.pdf 942B
inquiry for AP-103- FM-2400 project.exe

.exe 1.3MB

07082024_0840_06082024_inquiry for AP-103- FM-2400 project.rar

SHA256 c3b40aa0812f285a67bcf3f113f90c6aa3b4e6ace44ddc6fb7431291876f45f2
MD5 6ef854a9770861006e94d30f49fe63dd
SHA1 b27d7958f0b9bee172aee7cad0381e0dbf42b4ff
SHA512 b84f914ea095a16e54e3faa326e9aa888cdb70ca3d2f1d5bca23a40b78fa73d393c04ed65540a553ed9fc06991caaeb201ae28052b69ba005007ec60bcf03f47
SSDEEP 12288:Tbumyi0FeWtkvS+0lguViZZiyKWHysgOE/s3ntdY0LrhnGnc7FMVD6la6GKwrbD:Tu7bhblXoyWHysdEq20vhnvouD8D
MD5 SHA1 SHA512 SSDEEP

Password

infected

inquiry for AP-103- FM-2400 project.exe

IMPHASH c4540f421523fe2dc591e50be5ad7d0b
SHA256 918c87e623bdba94aaec14244552a012874d52af11ae70c6b7d1380929c3d0a4
MD5 fc3aaf1365032c9eb02fdbe1cfb5458c
SHA1 3d6c239b15d7fc5fc117ae4418259ec08e63922a
SHA512 44505c08bd7cd5cbc93311e66139c46133ac10f86d32ab8d15b72130ce31ec5089b154cdf60763da655a2bd5502be29bc57ec0df104bd08d4f68aab65c9b5fe4
SSDEEP 24576:DqDEvCTbMWu7rQYlBQcBiT6rprG8ayStNEo9LE+0JMnCA9tips:DTvC/MTQYxsWR7aySt3AMnVC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

132471

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

gethostbyname recv send socket inet_ntoa setsockopt ntohs WSACleanup WSAStartup sendto htons __WSAFDIsSet select accept listen bind inet_addr ioctlsocket recvfrom WSAGetLastError closesocket gethostname connect

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_ReplaceIcon ImageList_Destroy ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove InitCommonControlsEx ImageList_Create

mpr

WNetGetConnectionW WNetCancelConnection2W WNetUseConnectionW WNetAddConnection2W

wininet

HttpOpenRequestW InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetQueryOptionW InternetConnectW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetReadFile InternetQueryDataAvailable

psapi

GetProcessMemoryInfo

iphlpapi

IcmpSendEcho IcmpCloseHandle IcmpCreateFile

userenv

DestroyEnvironmentBlock LoadUserProfileW CreateEnvironmentBlock UnloadUserProfile

uxtheme

IsThemeActive

kernel32

DuplicateHandle CreateThread WaitForSingleObject HeapAlloc GetProcessHeap HeapFree Sleep GetCurrentThreadId MultiByteToWideChar MulDiv GetVersionExW IsWow64Process GetSystemInfo FreeLibrary LoadLibraryA GetProcAddress SetErrorMode GetModuleFileNameW WideCharToMultiByte lstrcpyW lstrlenW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx SetEndOfFile ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW FindClose GetLongPathNameW GetShortPathNameW DeleteFileW IsDebuggerPresent CopyFileExW MoveFileW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency LoadResource LockResource SizeofResource OutputDebugStringW GetTempPathW GetTempFileNameW DeviceIoControl LoadLibraryW GetLocalTime CompareStringW GetCurrentThread EnterCriticalSection LeaveCriticalSection GetStdHandle CreatePipe InterlockedExchange TerminateThread LoadLibraryExW FindResourceExW CopyFileW VirtualFree FormatMessageW GetExitCodeProcess GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW SetFileAttributesW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW HeapReAlloc HeapSize GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetProcessIoCounters CreateProcessW GetProcessId SetPriorityClass VirtualAlloc GetCurrentDirectoryW lstrcmpiW DecodePointer GetLastError RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedDecrement InterlockedIncrement ResetEvent WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess CloseHandle GetFullPathNameW GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer ExitProcess GetModuleHandleExW ExitThread ResumeThread FreeLibraryAndExitThread GetACP GetDateFormatW GetTimeFormatW LCMapStringW GetStringTypeW GetFileType SetStdHandle GetConsoleCP GetConsoleMode ReadConsoleW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetCurrentDirectoryW FindNextFileW WriteConsoleW

user32

GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW CallWindowProcW ReleaseCapture SetCapture PeekMessageW GetInputState UnregisterHotKey CharLowerBuffW MonitorFromPoint MonitorFromRect LoadImageW mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu ClientToScreen GetCursorPos DeleteMenu CheckMenuRadioItem GetMenuItemID GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic FindWindowW SystemParametersInfoW LockWindowUpdate SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowLongW GetWindowThreadProcessId AttachThreadInput GetFocus GetWindowTextW SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity CloseDesktop CloseWindowStation OpenDesktopW RegisterHotKey GetCursorInfo SetWindowPos CopyImage AdjustWindowRectEx SetRect SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard BlockInput TrackPopupMenuEx GetMessageW SetProcessWindowStation GetProcessWindowStation OpenWindowStationW GetUserObjectSecurity MessageBoxW DefWindowProcW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon DispatchMessageW keybd_event TranslateMessage ScreenToClient

gdi32

EndPath DeleteObject GetTextExtentPoint32W ExtCreatePen StrokeAndFillPath GetDeviceCaps SetPixel CloseFigure LineTo AngleArc MoveToEx Ellipse CreateCompatibleBitmap CreateCompatibleDC PolyDraw BeginPath Rectangle SetViewportOrgEx GetObjectW SetBkMode RoundRect SetBkColor CreatePen SelectObject StretchBlt CreateSolidBrush SetTextColor CreateFontW GetTextFaceW GetStockObject CreateDCW GetPixel DeleteDC GetDIBits StrokePath

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

GetAce RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegConnectRegistryW InitializeSecurityDescriptor InitializeAcl AdjustTokenPrivileges OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW GetLengthSid CopySid LogonUserW AllocateAndInitializeSid CheckTokenMembership FreeSid GetTokenInformation RegCreateKeyExW GetSecurityDescriptorDacl GetAclInformation GetUserNameW AddAce SetSecurityDescriptorDacl InitiateSystemShutdownExW

shell32

DragFinish DragQueryPoint ShellExecuteExW DragQueryFileW SHEmptyRecycleBinW SHGetPathFromIDListW SHBrowseForFolderW SHCreateShellItem SHGetDesktopFolder SHGetSpecialFolderLocation SHGetFolderPathW SHFileOperationW ExtractIconExW Shell_NotifyIconW ShellExecuteW

ole32

CoTaskMemAlloc CoTaskMemFree CLSIDFromString ProgIDFromCLSID CLSIDFromProgID OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoCreateInstance IIDFromString StringFromGUID2 CreateStreamOnHGlobal OleInitialize OleUninitialize CoInitialize CoUninitialize GetRunningObjectTable CoGetInstanceFromFile CoGetObject CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket

oleaut32

CreateStdDispatch CreateDispTypeInfo UnRegisterTypeLi UnRegisterTypeLibForUser RegisterTypeLibForUser RegisterTypeLi LoadTypeLibEx VariantCopyInd SysReAllocString SysFreeString VariantChangeType SafeArrayDestroyData SafeArrayUnaccessData SafeArrayAccessData SafeArrayAllocData SafeArrayAllocDescriptorEx SafeArrayCreateVector SysStringLen QueryPathOfRegTypeLi SysAllocString VariantInit VariantClear DispCallFunc VariantTimeToSystemTime VarR8FromDec SafeArrayGetVartype SafeArrayDestroyDescriptor VariantCopy OleLoadPicture