18092024_0101_17092024_cotización.PDF_98776456879808756846576879806765687976457687986764.bz2
- SHA256 6d121a6dc5d83a314d50c200a9bb80997585122c770b70f5905de16c550e3824
Password
infected
Behavioral task
behavioral1
Sample
cotización.PDF_98776456879808756846576879806765687976457687986764.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral2
Sample
cotización.PDF_98776456879808756846576879806765687976457687986764.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
300 seconds
General
- Target 18092024_0101_17092024_cotización.PDF_98776456879808756846576879806765687976457687986764.bz2
- Size 833KB
- Sample240918-bdlyxstgrh
- SHA256 6d121a6dc5d83a314d50c200a9bb80997585122c770b70f5905de16c550e3824
- MD5 8b6fef19071d62a624c52eaf9b697741
- SHA1 435bc6a4403f492a39970996fc0171bab863e8f4
- SHA512 bb067e1a7b86868b61b9dcdd882d62775f9681e48f74de664a25a84314e9d17b485b904f96fc612e60ea9b3c0a41746f990ef9580edd90003f434ad709363743
- SSDEEP 24576:kr/llbDMdvT+mW6RFIwdgNjLex3ShhUYR:k5lENT+QjISgNjLeQnUK
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/cotización.PDF_98776456879808756846576879806765687976457687986764.bat upx - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/cotización.PDF_98776456879808756846576879806765687976457687986764.bat unpack002/out.upx
File Explorer
-
18092024_0101_17092024_cotización.PDF_98776456879808756846576879806765687976457687986764.bz2.rar 833KB
-
cotización.PDF_98776456879808756846576879806765687976457687986764.bat.exe 88.0MB
-
out.upx.exe 634KB
cotización.PDF_98776456879808756846576879806765687976457687986764.bat
- SHA256 001b21318e75c49c1b0e415008530611da89163328b29d65ade1f7edde25328d
- MD5 e4a8ce0f507c8ba1023007a3fcfdef7e
- SHA1 ae93d87dc7532f2c330e2ab7d39a39f131dd959b
- SHA512 97370fc754fb67fa95042e706894a4e36fe7f5337aff32490506e7f7738050c6dc2bec68561a1228312bf99985aeb330701b440a57e169416c1a690cd61220fa
- SSDEEP 12288:v6Wq4aaE6KwyF5L0Y2D1PqLuKjL6vV34jxMQzpWlXeXpddOgLWHlqd48EJGpZpGe:tthEVaPqLnLoVqxsuX9uqd4nG/pG3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
5
Entry point
757360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
472KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
264KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 fcdf46fc4db849adf0b4127317d2bbc86ab9d00d1756095f7d0f98f835276c2a
- MD5 d67ea5285c3c56c6fdc8f2a28354bd44
- SHA1 53350bfe1a1c7b668cd42bc7c1eddc4383875b85
- SHA512 6e2c876f5102336c6ff825ecd4319bc1fb2a2343b04606d60d9640fc0c1baf3f2be1d0b3f37dd5d40d9e4df49c8299322fbc97e9b4f9f50dbcbd71f700ce16d1
- SSDEEP 12288:WhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJc:GRmJkcoQricOIQxiZY1
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
91585
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
514KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,