20092024075920092024signedcontract.zip
- SHA256 8785dff9a984f1afb94206ed984921c85e1d6e821b209296e9f7642961239f17
Behavioral task
behavioral1
Sample
signed contract.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
- Target 20092024075920092024signedcontract.zip
- Size 748KB
- Sample240920-qjdl3ayalf
- SHA256 8785dff9a984f1afb94206ed984921c85e1d6e821b209296e9f7642961239f17
- MD5 07bb57407e7b988e6b084386fcd73423
- SHA1 f6c0d42fa12a200a87aa565cba169ffa7b7e108c
- SHA512 7570b5c497906ed365a851452dada6926d46dc954c9c4236f4de9f4b419efa63a837c323ef94a0cc5d157745032410803414b8fd32ec65add528af60623d9c98
- SSDEEP 12288:D/gBT51V14eECqni+OaTp+fCN5+CTO5Tnv9bm2cZB4f7cEIsvIUhwh7UQtJZIFO8:jgBTS7nt3+fC7+0O5Tv7QBUchUwOmgc8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/signed contract.exe upx - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/signed contract.exe unpack002/out.upx
File Explorer
-
20092024075920092024signedcontract.zip.zip 748KB
-
signed contract.exe.exe 762KB
-
out.upx.exe 634KB
signed contract.exe
- SHA256 8d83a9a3bbd6e63e37b6d66c4febdbcf17a48fe77fabdd52c5bfa01a661a33da
- MD5 1cfab4e68a14edd1b9a4c54561a8aa69
- SHA1 6712b67cc45056cc9d3bd27c0a5f6b5c29eabae1
- SHA512 a3f100f9a0026e29352c2af3e94ab0f20bd4c45799545b0104b6c1029d2904d9b06a160f58db7a3467562686cdabd4cfd74d8ea5b49af68a31fc541490b759d0
- SSDEEP 12288:v6Wq4aaE6KwyF5L0Y2D1PqL8CN5+CROltnD9bmAcZBYfFcEYsvIU/wR7UmtJZeFQ:tthEVaPqL8C7+wOltDrQB0cPUwesmrS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
757360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
472KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
264KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 fcdf46fc4db849adf0b4127317d2bbc86ab9d00d1756095f7d0f98f835276c2a
- MD5 d67ea5285c3c56c6fdc8f2a28354bd44
- SHA1 53350bfe1a1c7b668cd42bc7c1eddc4383875b85
- SHA512 6e2c876f5102336c6ff825ecd4319bc1fb2a2343b04606d60d9640fc0c1baf3f2be1d0b3f37dd5d40d9e4df49c8299322fbc97e9b4f9f50dbcbd71f700ce16d1
- SSDEEP 12288:WhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJc:GRmJkcoQricOIQxiZY1
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
91585
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
514KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,