FOXAUTO V8[.]zip | Triage

Sharing

General

Target

FOXAUTO V8.zip
Size

16.7MB
MD5

2dbe69c2a2a25b80a86e048ad1d872d2
SHA1

ddfa838f0d32c4904ece33ec278c4ac4f9fe64c8
SHA256

6e9cab5ac9495c9799c87056bdf570dc36a2e03eab08703ed659cc7b8b35ac12
SHA512

38e5b6f01a120b2888a169cce426a9f0ac4c37b2c6ce8d7572181cef11366a53cf7e62536284f3df078fb254274bad20a9ec5e55d21e5b57dd97366d2bc0e26f
SSDEEP

393216:8yCHJnn9Sk8zsOOH+qg9BvyYuSnohM1QQt:8XH19Sk8zsb+qypypYlTt

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

resource	yara_rule
static1/unpack001/FOXAUTO V8/FoxAutoV8.exe	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/FOXAUTO V8/FoxAutoV8.exe

Files

FOXAUTO V8.zip
.zip

Password: 1
FOXAUTO V8/400.txt
FOXAUTO V8/FoxAutoV8.exe
.exe windows:4 windows x86 arch:x86

Password: 1

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

FoxAutoV8.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 17.1MB - Virtual size: 17.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FoxAutoV8.pyc
FOXAUTO V8/FoxAutoV8.py
Password.txt