17092024055417092024oc202486545346576879879856879876756875246[.]XLS[.]uue

Sharing

Copy URL Twitter E-mail

General

Target
17092024055417092024oc202486545346576879879856879876756875246.XLS.uue
Size 799KB
Sample240917-svve3aybpc
SHA256 941402f57a96debb7dd383b23396f2af8294bc070ef10250bdccbd2b148e0813
MD5 74a265ddd2ac5a2ca37b780e9fd5ec94
SHA1 ec5804cfebaeffe6416d7ee247fdf06900996c2a
SHA512 a4fed7cdbedffec0ba1c2f1550f0e5cfc05051afe4183ae88f54cc93071068028c65d47da2b45ce8ae2ca5073794da96e7e81d083cf8f2e0152b90015245eb47
SSDEEP 24576:Bp5DeSAyNwpPrwiuxL65GXvAp13q+faC97NqGtVz09:B9NMuTXob39i67N7e
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/oc_202486545346576879879856879876756875246.exe	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/oc_202486545346576879879856879876756875246.exe

File Explorer

17092024055417092024oc202486545346576879879856879876756875246.XLS.uue

.rar 799KB
oc_202486545346576879879856879876756875246.exe

.exe 1.1MB

17092024055417092024oc202486545346576879879856879876756875246.XLS.uue

SHA256 941402f57a96debb7dd383b23396f2af8294bc070ef10250bdccbd2b148e0813
MD5 74a265ddd2ac5a2ca37b780e9fd5ec94
SHA1 ec5804cfebaeffe6416d7ee247fdf06900996c2a
SHA512 a4fed7cdbedffec0ba1c2f1550f0e5cfc05051afe4183ae88f54cc93071068028c65d47da2b45ce8ae2ca5073794da96e7e81d083cf8f2e0152b90015245eb47
SSDEEP 24576:Bp5DeSAyNwpPrwiuxL65GXvAp13q+faC97NqGtVz09:B9NMuTXob39i67N7e
MD5 SHA1 SHA512 SSDEEP

oc_202486545346576879879856879876756875246.exe

IMPHASH 04b4eec1b14791bf23f31173f27a5df0
SHA256 6d7383506176b2d66904efea5dfee58a70ad683ee01d9bf6a49066a92ab81cf6
MD5 ef3b33eda19bdf6cc936b97f7e582f1d
SHA1 2f67db5fb6220c97ade8c9a016e0553af766efe3
SHA512 975c729679891c2552d9f444a6f68f80ca122c6476599efe1b257791695647577c7b003146ef5dd457ead393d5da42b74949a6aadb514d24847d5e4bce1924e3
SSDEEP 24576:0RmJkcoQricOIQxiZY1iaae3Ut4xK9+UfLWYG6uwiQizOVEC0ZL:RJZoQrbTFZY1iaaYQ409XmZwnizOVa
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

91585

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

__WSAFDIsSet setsockopt ntohs recvfrom sendto htons select listen WSAStartup bind closesocket connect socket send WSACleanup ioctlsocket accept WSAGetLastError inet_addr gethostbyname gethostname recv

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove ImageList_ReplaceIcon ImageList_Create InitCommonControlsEx ImageList_Destroy

mpr

WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W WNetUseConnectionW

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetConnectW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetQueryOptionW InternetQueryDataAvailable

psapi

EnumProcesses GetModuleBaseNameW GetProcessMemoryInfo EnumProcessModules

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock UnloadUserProfile LoadUserProfileW

kernel32

HeapAlloc Sleep GetCurrentThreadId RaiseException MulDiv GetVersionExW GetSystemInfo InterlockedIncrement InterlockedDecrement WideCharToMultiByte lstrcpyW MultiByteToWideChar lstrlenW lstrcmpiW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW FindClose DeleteFileW FindNextFileW MoveFileW CopyFileW CreateDirectoryW RemoveDirectoryW GetProcessHeap QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource EnumResourceNamesW OutputDebugStringW GetLocalTime CompareStringW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetStdHandle CreatePipe InterlockedExchange TerminateThread GetTempPathW GetTempFileNameW VirtualFree FormatMessageW GetExitCodeProcess SetErrorMode GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW DeviceIoControl SetFileAttributesW GetShortPathNameW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetCurrentThread GetProcessIoCounters CreateProcessW SetPriorityClass LoadLibraryW VirtualAlloc LoadLibraryExW HeapFree WaitForSingleObject CreateThread DuplicateHandle GetLastError CloseHandle GetCurrentProcess GetProcAddress LoadLibraryA FreeLibrary GetModuleFileNameW GetFullPathNameW SetCurrentDirectoryW IsDebuggerPresent GetCurrentDirectoryW ExitProcess ExitThread GetSystemTimeAsFileTime ResumeThread GetTimeFormatW GetDateFormatW GetCommandLineW GetStartupInfoW IsProcessorFeaturePresent HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter GetStringTypeW HeapCreate SetHandleCount GetFileType SetStdHandle GetConsoleCP GetConsoleMode LCMapStringW RtlUnwind SetFilePointer GetTimeZoneInformation FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount HeapReAlloc WriteConsoleW SetEndOfFile SetSystemPowerState SetEnvironmentVariableA

user32

GetCursorInfo RegisterHotKey ClientToScreen GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW ReleaseCapture SetCapture WindowFromPoint LoadImageW CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu TrackPopupMenuEx GetCursorPos DeleteMenu CheckMenuRadioItem SetWindowPos GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic FindWindowW SystemParametersInfoW TranslateMessage SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowLongW AttachThreadInput GetFocus GetWindowTextW ScreenToClient SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity GetUserObjectSecurity CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation OpenWindowStationW MessageBoxW DefWindowProcW CopyImage AdjustWindowRectEx SetRect SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard BlockInput GetMessageW LockWindowUpdate GetMenuItemID DispatchMessageW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon PeekMessageW UnregisterHotKey CharLowerBuffW keybd_event MonitorFromRect GetWindowThreadProcessId

gdi32

DeleteObject AngleArc GetTextExtentPoint32W ExtCreatePen StrokeAndFillPath StrokePath EndPath SetPixel CloseFigure CreateCompatibleBitmap CreateCompatibleDC SelectObject StretchBlt GetDIBits GetDeviceCaps MoveToEx DeleteDC GetPixel CreateDCW Ellipse PolyDraw BeginPath Rectangle SetViewportOrgEx GetObjectW SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush SetTextColor CreateFontW GetTextFaceW GetStockObject LineTo

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegCreateKeyExW GetUserNameW RegConnectRegistryW CloseServiceHandle UnlockServiceDatabase OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW InitializeSecurityDescriptor InitializeAcl GetLengthSid CopySid LogonUserW LockServiceDatabase GetTokenInformation GetSecurityDescriptorDacl GetAclInformation GetAce AddAce SetSecurityDescriptorDacl RegOpenKeyExW RegQueryValueExW AdjustTokenPrivileges InitiateSystemShutdownExW OpenSCManagerW RegCloseKey

shell32

DragQueryPoint ShellExecuteExW SHGetFolderPathW DragQueryFileW SHEmptyRecycleBinW SHBrowseForFolderW SHFileOperationW SHGetPathFromIDListW SHGetDesktopFolder SHGetMalloc ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CLSIDFromString StringFromGUID2 CoInitialize CoUninitialize CoCreateInstance CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemFree ProgIDFromCLSID OleInitialize CreateBindCtx CLSIDFromProgID CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket OleUninitialize IIDFromString

oleaut32

VariantChangeType VariantCopyInd DispCallFunc CreateStdDispatch CreateDispTypeInfo SysFreeString SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnaccessData SysStringLen SafeArrayAllocData GetActiveObject QueryPathOfRegTypeLi SafeArrayAllocDescriptorEx SafeArrayCreateVector SysAllocString VariantCopy VariantClear VariantTimeToSystemTime VarR8FromDec SafeArrayGetVartype OleLoadPicture SafeArrayAccessData VariantInit