f3243a385c52c660c7c590a7ef77324199c3ccdd8fb70ed3292028afc2583c82.rar
- SHA256 f3243a385c52c660c7c590a7ef77324199c3ccdd8fb70ed3292028afc2583c82
Behavioral task
behavioral1
Sample
M20240930086..exe
Resource
win7-20240704-en
windows7-x64
13 signatures
150 seconds
General
- Target f3243a385c52c660c7c590a7ef77324199c3ccdd8fb70ed3292028afc2583c82.rar
- Size 730KB
- Sample240925-c91bvstdnh
- SHA256 f3243a385c52c660c7c590a7ef77324199c3ccdd8fb70ed3292028afc2583c82
- MD5 7a6ad3eb134817a5399fbaa75751e0d5
- SHA1 d62b0881467259c994f4c302a91eec65cf92b24a
- SHA512 8d2de632a73e751ba6a88e38792eca7fdb57bb8c9bb1426fc5f566ce642961d86a39848b1e0d050759851170a292890cd5722d523df1060836bf0297afbe1c38
- SSDEEP 12288:zeWptFedEgot+gCiaZvUzXKHdiTH8E6zhGI0e73FUMFvAVa+1A+qWdtj80Noetkz:zTeOgwCi8v4X0diTHTNk3qMFnCdtjVSp
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/M20240930086..exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/M20240930086..exe unpack002/out.upx
File Explorer
-
f3243a385c52c660c7c590a7ef77324199c3ccdd8fb70ed3292028afc2583c82.rar.rar 730KB
-
M20240930086..exe.exe 744KB
-
out.upx.exe 634KB
M20240930086..exe
- SHA256 36421bdf90ea83d4e677a54710f4d35e2bc15a1222c4abb17e78996029f53c97
- MD5 1f3a6997ed55ef6be6beccfc1996e011
- SHA1 e79c2dde745697bace3bc0efceb136b4796b61a0
- SHA512 75a895a1e52929af7c3799ac4a609989246659c2e3cf9dc076bc873d089dbd47219eeb8ba4fdcb82c8fe5d1215dbd0f59eab69b43afe782e8268b140a5cdcb18
- SSDEEP 12288:v6Wq4aaE6KwyF5L0Y2D1PqLRMiO8RxrhwK9kNr2rReqSHmZBGtA/q80okL3Rf:tthEVaPqLRlO8VCx2NeqlTOt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
757360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
472KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
264KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 fcdf46fc4db849adf0b4127317d2bbc86ab9d00d1756095f7d0f98f835276c2a
- MD5 d67ea5285c3c56c6fdc8f2a28354bd44
- SHA1 53350bfe1a1c7b668cd42bc7c1eddc4383875b85
- SHA512 6e2c876f5102336c6ff825ecd4319bc1fb2a2343b04606d60d9640fc0c1baf3f2be1d0b3f37dd5d40d9e4df49c8299322fbc97e9b4f9f50dbcbd71f700ce16d1
- SSDEEP 12288:WhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJc:GRmJkcoQricOIQxiZY1
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
91585
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
514KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,