ec55ddef21919ad988eb72c41a732ddcd433acd6e90e916b149158fc713c6ec0

General

Target
ec55ddef21919ad988eb72c41a732ddcd433acd6e90e916b149158fc713c6ec0
Size 748KB
Sample240920-vdd3vsxcnk
SHA256 ec55ddef21919ad988eb72c41a732ddcd433acd6e90e916b149158fc713c6ec0
MD5 147804f0d3f45bdb8449260566179efb
SHA1 ceefa53bf4f1762cbe00cbe4a648197cd741f577
SHA512 cc04275d2835ed6e31c24263ddee006b164398b27255f8c6d95aac2c3cd33db152ec36d5355e2400c0a8959f1905ee130f61c4c1a9593352f89d302196064c7c
SSDEEP 12288:y/gBT51V14eECqni+OaTp+fCN5+CTO5Tnv9bm2cZB4f7cEIsvIUhwh7UQtJZIFOX:QgBTS7nt3+fC7+0O5Tv7QBUchUwOmgcX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/e-invoice.exe	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack002/out.upx	autoit_exe

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e-invoice.exe
unpack002/out.upx

File Explorer

ec55ddef21919ad988eb72c41a732ddcd433acd6e90e916b149158fc713c6ec0

.zip 748KB
e-invoice.exe

.exe 762KB
out.upx

.exe 634KB

ec55ddef21919ad988eb72c41a732ddcd433acd6e90e916b149158fc713c6ec0

SHA256 ec55ddef21919ad988eb72c41a732ddcd433acd6e90e916b149158fc713c6ec0
MD5 147804f0d3f45bdb8449260566179efb
SHA1 ceefa53bf4f1762cbe00cbe4a648197cd741f577
SHA512 cc04275d2835ed6e31c24263ddee006b164398b27255f8c6d95aac2c3cd33db152ec36d5355e2400c0a8959f1905ee130f61c4c1a9593352f89d302196064c7c
SSDEEP 12288:y/gBT51V14eECqni+OaTp+fCN5+CTO5Tnv9bm2cZB4f7cEIsvIUhwh7UQtJZIFOX:QgBTS7nt3+fC7+0O5Tv7QBUchUwOmgcX
MD5 SHA1 SHA512 SSDEEP

e-invoice.exe

SHA256 8d83a9a3bbd6e63e37b6d66c4febdbcf17a48fe77fabdd52c5bfa01a661a33da
MD5 1cfab4e68a14edd1b9a4c54561a8aa69
SHA1 6712b67cc45056cc9d3bd27c0a5f6b5c29eabae1
SHA512 a3f100f9a0026e29352c2af3e94ab0f20bd4c45799545b0104b6c1029d2904d9b06a160f58db7a3467562686cdabd4cfd74d8ea5b49af68a31fc541490b759d0
SSDEEP 12288:v6Wq4aaE6KwyF5L0Y2D1PqL8CN5+CROltnD9bmAcZBYfFcEYsvIU/wR7UmtJZeFQ:tthEVaPqL8C7+wOltDrQB0cPUwesmrS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

757360

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 fcdf46fc4db849adf0b4127317d2bbc86ab9d00d1756095f7d0f98f835276c2a
MD5 d67ea5285c3c56c6fdc8f2a28354bd44
SHA1 53350bfe1a1c7b668cd42bc7c1eddc4383875b85
SHA512 6e2c876f5102336c6ff825ecd4319bc1fb2a2343b04606d60d9640fc0c1baf3f2be1d0b3f37dd5d40d9e4df49c8299322fbc97e9b4f9f50dbcbd71f700ce16d1
SSDEEP 12288:WhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJc:GRmJkcoQricOIQxiZY1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

91585

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

ec55ddef21919ad988eb72c41a732ddcd433acd6e90e916b149158fc713c6ec0

e-invoice.exe

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

ec55ddef21919ad988eb72c41a732ddcd433acd6e90e916b149158fc713c6ec0

e-invoice.exe

generic

out.upx

generic