16092024_0912_16092024_RFQ REF-JTCAJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.zip
- SHA256 7c3d71786ef85ec70f27b53e7bdd98f202398a77d52399d49135cf5e187a3dab
Password
infected
Behavioral task
behavioral1
Sample
RFQ REF-JTCAJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe
Resource
win7-20240708-en
windows7-x64
16 signatures
300 seconds
General
- Target 16092024_0912_16092024_RFQ REF-JTCAJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.zip
- Size 934KB
- Sample240916-k568lszbrk
- SHA256 7c3d71786ef85ec70f27b53e7bdd98f202398a77d52399d49135cf5e187a3dab
- MD5 3f8bdebacbb560b2a43895b9f2450f47
- SHA1 3677b368af393ba2a2deaf49dc6182bde0c4e769
- SHA512 b3c06a9d290cb593dfbec09cb2dabb38f444177bdd1ffb146bb948327a5cb116e4e1a62b705ee8a7f699d1ad7976a3d3e19edf482c991a9c010898514147d357
- SSDEEP 24576:39ku+84jWVcYVvoqY2kiUlWHyM/bfUfOccxNlIcthLO6Tf+K74:39kuhq69VBY2ssLQfMycLOy2K74
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/RFQ REF-JTCAJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe upx - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/RFQ REF-JTCAJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe unpack002/out.upx
File Explorer
-
16092024_0912_16092024_RFQ REF-JTCAJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.zip.zip 934KB
-
RFQ REF-JTCAJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe.exe 959KB
-
out.upx.exe 1.4MB
RFQ REF-JTCAJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe
- SHA256 b967a8b7765a762514d4b8d172fabb655af83d7279fd15cd513e217675ce96a9
- MD5 a4be50bb39110e49c1d2fc87ccc12f56
- SHA1 ffc4874f95b0c774ad54988350128eadfaeebc23
- SHA512 241476b5ab26dc7a8673daca8cb6b76b46b9e87092e09e7db643368b8514d439e1bf502a42b9f6b082ce2fc92c3ca2141bd34e8068bc77820c06d4892242f575
- SSDEEP 24576:hiUmSB/o5d1ubcvLiUlytyo/bfUbycmjNlscnVDO8TR+KDV:h/mU/ohubcvhMXQb6kcROgIKD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
1537888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
371KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
587KB
Virtual Size
588KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
out.upx
- SHA256 0dc2d8b7fb1e0f5d7c670df7eb1dde06337343a22d5acdfe9afbd5a6b52c798a
- MD5 81ed6b934fd307a47c61d0009e62dde8
- SHA1 430634e39440cab1ae7a9fb4c53855474eb4b51c
- SHA512 e342523fc4e9c9763c5e27a3929976b856d7f2ab11d9e8c3a54c73737406609228e3e72ca9cc614e7b5fc66c04131c8adabb55aac5d688151bd819b22163c627
- SSDEEP 24576:FqDEvCTbMWu7rQYlBQcBiT6rp3doiUlytyo/bfUbycmjNlscnVDO8TR+KDV:FTvC/MTQYxsW5+MXQb6kcROgIKD
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
132471
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
619KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
595KB
Virtual Size
594KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,