455649189a1cfad01fcbb626a27061c25c610851c80d74e527dfbbf29617b553
- SHA256 455649189a1cfad01fcbb626a27061c25c610851c80d74e527dfbbf29617b553
Password
infected
Behavioral task
behavioral1
Sample
fd9725ecc7ed625c2174660e7f51f647fff9474f4c21c8ed84e0608bbcc5a409.exe
Resource
win7-20240708-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
fd9725ecc7ed625c2174660e7f51f647fff9474f4c21c8ed84e0608bbcc5a409.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 455649189a1cfad01fcbb626a27061c25c610851c80d74e527dfbbf29617b553
- Size 558KB
- Sample240914-trtvsssgmk
- SHA256 455649189a1cfad01fcbb626a27061c25c610851c80d74e527dfbbf29617b553
- MD5 29a360e330aad66b2b5b4947a973e699
- SHA1 ce5da037244430628d3d5317cef75edf5d6221a0
- SHA512 e97ca4c5a68bdbe49524b4aadfa87783c9bc08c1c2adfd67da46e6043367479a2d6a0c60303aa8f275a0b0cfbe16c0dd14f49477e1dcb5184038820b5d5a0bce
- SSDEEP 12288:cUp5dfk+oxbYT5MH6dVOI/XkJyC3xl1Zblikqt2iLrMmcUCME7ErJI:coDfkT8TKoOE0/znYkqt2iLN4AI
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/fd9725ecc7ed625c2174660e7f51f647fff9474f4c21c8ed84e0608bbcc5a409.exe upx - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/fd9725ecc7ed625c2174660e7f51f647fff9474f4c21c8ed84e0608bbcc5a409.exe unpack002/out.upx
File Explorer
-
455649189a1cfad01fcbb626a27061c25c610851c80d74e527dfbbf29617b553.zip 558KB
-
fd9725ecc7ed625c2174660e7f51f647fff9474f4c21c8ed84e0608bbcc5a409.exe.exe 583KB
-
out.upx.exe 1.0MB
fd9725ecc7ed625c2174660e7f51f647fff9474f4c21c8ed84e0608bbcc5a409.exe
- SHA256 fd9725ecc7ed625c2174660e7f51f647fff9474f4c21c8ed84e0608bbcc5a409
- MD5 d6f99a0cc11e32ea897bc97a319748ab
- SHA1 006a848fd606c3799ef9ec23ff47fbb81900bc74
- SHA512 dc1af6b89f41a83d9eb84304fb1e9dff8e62de312f6c1245f1d0850bebd0596ab99e3548df6b36d9db7bb953882c745ee8a94cc4a9258b447fc5dec0ffa9b621
- SSDEEP 12288:TXe9PPlowWX0t6mOQwg1Qd15CcYk0We1FY/Hd2sQIsXSBBCWENB:6hloDX0XOf4Kd2EsCjCW+B
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1134672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
768KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
337KB
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
245KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=199, version=41118,
count=51, id=205, version=50929,
count=177, id=206, version=50929,
count=50, id=207, version=50929,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=530, id=1, productName=Unmarked objects,
count=77, id=216, version=61030,
count=2, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
out.upx
- SHA256 89c262816fa094331b94428ed8283413a398a0aec6dc18a9a62b5634ea8401bf
- MD5 2fb7936b3bc4fe86f6099437b94eb27c
- SHA1 794f3b1e2b71747b639ccd24f21d9994312d60ea
- SHA512 0cc7e7851e5ec41f88b5bcf9c6ae87551342552ffb9689548475de61ad38c9ae32186793cd6c0f9e13659b957b8a3ec5dc27357a4b62d2e6444333a0483e15b4
- SSDEEP 12288:74lsXvtCcmVVXzzn4PJAahPl/QEdIMiVbHydE+JnJW0/Hd2sQIsXSBBCWENB:74lavt0LkLL9IMixoEK3d2EsCjCW+B
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
158711
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
560KB
Virtual Size
559KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
253KB
Virtual Size
252KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=51, id=205, version=50929,
count=177, id=206, version=50929,
count=50, id=207, version=50929,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=530, id=1, productName=Unmarked objects,
count=77, id=216, version=61030,
count=2, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,