8dcf6b86f74dcb0f83f203a7b34ba8a15c965a453c39a661fce9b6ba4d109cc4

General

Target
8dcf6b86f74dcb0f83f203a7b34ba8a15c965a453c39a661fce9b6ba4d109cc4
Size 744KB
Sample240924-sefa7stcpd
SHA256 8dcf6b86f74dcb0f83f203a7b34ba8a15c965a453c39a661fce9b6ba4d109cc4
MD5 24acd887788de94477ac871417d748d5
SHA1 34196a74c386775a54d19520662f94c811e5be2f
SHA512 4a014e5b854235b1c5a45e92952e5dffbacae933e044e5ed245a24f6f17ed70734f0786ea9161b065f0a7c47e956ba5cf6ceb0f51da442c4a90a45029743e97a
SSDEEP 12288:b/gBT51V14eECqni+Oa84aR73OyCsGh5eUVtx6AfDieqV2jqPH88bGVUCYv++:LgBTS7nt+3DvCVh5eAtxDGevjqPH88/p
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack002/out.upx	autoit_exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Invoice, Parking List.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Invoice, Parking List.exe
unpack002/out.upx

File Explorer

8dcf6b86f74dcb0f83f203a7b34ba8a15c965a453c39a661fce9b6ba4d109cc4

.zip 744KB
Invoice, Parking List.exe

.exe 758KB
out.upx

.exe 634KB

8dcf6b86f74dcb0f83f203a7b34ba8a15c965a453c39a661fce9b6ba4d109cc4

SHA256 8dcf6b86f74dcb0f83f203a7b34ba8a15c965a453c39a661fce9b6ba4d109cc4
MD5 24acd887788de94477ac871417d748d5
SHA1 34196a74c386775a54d19520662f94c811e5be2f
SHA512 4a014e5b854235b1c5a45e92952e5dffbacae933e044e5ed245a24f6f17ed70734f0786ea9161b065f0a7c47e956ba5cf6ceb0f51da442c4a90a45029743e97a
SSDEEP 12288:b/gBT51V14eECqni+Oa84aR73OyCsGh5eUVtx6AfDieqV2jqPH88bGVUCYv++:LgBTS7nt+3DvCVh5eAtxDGevjqPH88/p
MD5 SHA1 SHA512 SSDEEP

Invoice, Parking List.exe

SHA256 1a52416bc054c0f2a46f2fd215d73d3285334fcdacf02ed449935bd93fb70863
MD5 6e39ee33f6527364cac3cc4bbf276f26
SHA1 a7c12eef84ae778ce5158327d419508eb5b199c8
SHA512 d06164091fe866df2626377b2d2589d9da291c73aff55b40db1844e32290c1f5e37b1ba8155ee02a351366df5a8862ce0b2e5b28a9b14b65cd568064cde28a78
SSDEEP 12288:v6Wq4aaE6KwyF5L0Y2D1PqLVRX3OyQsAhJYUVTx6AflSeqz2jqPB88bYVUCYH5g:tthEVaPqL7nvQlhJYATxDYeHjqPB88ZO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

757360

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 fcdf46fc4db849adf0b4127317d2bbc86ab9d00d1756095f7d0f98f835276c2a
MD5 d67ea5285c3c56c6fdc8f2a28354bd44
SHA1 53350bfe1a1c7b668cd42bc7c1eddc4383875b85
SHA512 6e2c876f5102336c6ff825ecd4319bc1fb2a2343b04606d60d9640fc0c1baf3f2be1d0b3f37dd5d40d9e4df49c8299322fbc97e9b4f9f50dbcbd71f700ce16d1
SSDEEP 12288:WhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJc:GRmJkcoQricOIQxiZY1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

91585

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

8dcf6b86f74dcb0f83f203a7b34ba8a15c965a453c39a661fce9b6ba4d109cc4

Invoice, Parking List.exe

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

8dcf6b86f74dcb0f83f203a7b34ba8a15c965a453c39a661fce9b6ba4d109cc4

Invoice, Parking List.exe

generic

out.upx

generic