Overview
overview
7Static
static
7Fwd_ Cotiz...B).zip
windows11-21h2-x64
1a58cb4c9d6...64.eml
windows11-21h2-x64
3Cotizació...24.rar
windows11-21h2-x64
3Cotizació...24.exe
windows11-21h2-x64
7out.exe
windows11-21h2-x64
3email-html-2.html
windows11-21h2-x64
5email-plain-1.txt
windows11-21h2-x64
3image004.png
windows11-21h2-x64
3image005.png
windows11-21h2-x64
3Behavioral task
behavioral1
Sample
Fwd_ Cotización 22_08_2024-password(hP4lq2TB).zip
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
a58cb4c9d67405d377695c9e78451426d8aea3d30a18eb3944a3e0e887971c64.eml
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
Cotización 22_08_2024.rar
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
Cotización 22_08_2024.exe
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
out.exe
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
email-html-2.html
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
email-plain-1.txt
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
image004.png
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
image005.png
Resource
win11-20240802-en
General
-
Target
Fwd_ Cotización 22_08_2024-password(hP4lq2TB).zip
-
Size
1.2MB
-
MD5
4dbae34343c57a3f3e0582e669186bbd
-
SHA1
b4135ee9362aadd7da665bd6ca74d9764f7130f5
-
SHA256
4ec405f0cc865af5eb681650b0e6710ebd5c13a08582841854c1f8939730028f
-
SHA512
f928cebaf1ea309e77cb89f7cb52ff635de093ac095df9a7f1fd9d2351754b42541db693a8ee9d9433777ce4ae0f3e1d091b4a42832446c1cc5fd835dfb81c11
-
SSDEEP
24576:X8ZPFbPNKjMOkQJ6Wekj3MiaUKZSlPBUux9LeyyceUPd:MUjMfENZfKZ6Pl9LpPd
Malware Config
Signatures
-
resource yara_rule static1/unpack003/Cotización 22_08_2024.exe upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack004/out.upx autoit_exe -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack003/Cotización 22_08_2024.exe unpack004/out.upx
Files
-
Fwd_ Cotización 22_08_2024-password(hP4lq2TB).zip.zip
Password: hP4lq2TB
-
a58cb4c9d67405d377695c9e78451426d8aea3d30a18eb3944a3e0e887971c64.eml.eml
Password: hP4lq2TB
-
-
http:/www.ncsjaguar.com.mx/
-
https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient
-
-
Cotización 22_08_2024.uue.rar
Password: hP4lq2TB
-
Cotización 22_08_2024.exe.exe windows:5 windows x86 arch:x86
Password: hP4lq2TB
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 371KB - Virtual size: 372KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 652KB - Virtual size: 656KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 619KB - Virtual size: 618KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 191KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 660KB - Virtual size: 659KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
email-html-2.txt.html
-
email-plain-1.txt
-
image004.png.png
Password: hP4lq2TB
-
image005.png.png
Password: hP4lq2TB