24092024_1117_23092024_order.zip
- SHA256 3a0175a8c4f8020cb5cb6351a3de5e9b62d200550c8de848b5787269b4aaf0ca
Password
infected
Behavioral task
behavioral1
Sample
order.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
300 seconds
General
- Target 24092024_1117_23092024_order.zip
- Size 723KB
- Sample240924-nd6dsaserm
- SHA256 3a0175a8c4f8020cb5cb6351a3de5e9b62d200550c8de848b5787269b4aaf0ca
- MD5 33d253dc50cbfe390fbae318b8812dec
- SHA1 d717cd416c49720fcc24eeb3ff03d6c5570f3e92
- SHA512 00c7fe56223750f85337aedea482c58095e9f7890adc5bc89e515cece0c644c527d9f1bbc3b12e13fdd54eb9af3307e3bf086669d02c899fdfe8fa5a576dd99e
- SSDEEP 12288:k/gBT51V14eECqni+Oa5UwWOiMjh1nB7BGOL7PnZYojGaXM8fFyG8rxO8I:ugBTS7nt4wWOiMt1X/+o7MpG8FI
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/order.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/order.exe unpack002/out.upx
File Explorer
-
24092024_1117_23092024_order.zip.zip 723KB
-
order.exe.exe 737KB
-
out.upx.exe 634KB
order.exe
- SHA256 86f8d817d26e2a9566ac4500033855f9b17e50ad4276b9d488acbc53894edd91
- MD5 fe653d60442a24191e27c076014320e6
- SHA1 80079ce48688442186d910c921aef71a407f6b4f
- SHA512 62d6960bc2cc4a5f581315904a9ef2492b05ff7b13545e9ad747a224b76f56f84a331da830cab3f725eb1e6bbcef4e5082743a77d277447bffc09e4868b4ff00
- SSDEEP 12288:v6Wq4aaE6KwyF5L0Y2D1PqLF6iMfh1hB7BCOLPPnH+ojoAXM8fFyG87xO7S:tthEVaPqLF6iMJ1hDeopMHGSIS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
5
Entry point
757360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
472KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
264KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 fcdf46fc4db849adf0b4127317d2bbc86ab9d00d1756095f7d0f98f835276c2a
- MD5 d67ea5285c3c56c6fdc8f2a28354bd44
- SHA1 53350bfe1a1c7b668cd42bc7c1eddc4383875b85
- SHA512 6e2c876f5102336c6ff825ecd4319bc1fb2a2343b04606d60d9640fc0c1baf3f2be1d0b3f37dd5d40d9e4df49c8299322fbc97e9b4f9f50dbcbd71f700ce16d1
- SSDEEP 12288:WhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJc:GRmJkcoQricOIQxiZY1
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
91585
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
514KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,