New Order.zip
- SHA256 2592c99ac5bbdbad03df7ea4f754bdf4f6c9180502e5d93f59cb25d4f317e1e2
General
- Target New Order.zip
- Size 524KB
- Sample241022-tpblfawbkn
- SHA256 2592c99ac5bbdbad03df7ea4f754bdf4f6c9180502e5d93f59cb25d4f317e1e2
- MD5 2ba45f05a335d1b1740d1401bcebad39
- SHA1 7b87a171da03b1ca8248e7e2e4a203b258e79f16
- SHA512 6dbb52b4ddf304d1827e9f0ca4d38e9489950dbba7c752d412b7f011eca8c702de43ce16c77b5ba772fcae32c145483ebc79be3d4dc06e885a05e88575067656
- SSDEEP 12288:xt7iLdfmCiPIZDKzxW3rfjQo6t/SBQ1XRE434p/MOWAJZpQEF5kIowfG:xtuLdONPODkof0o69XECUiaWIffG
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/New Order.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/New Order.exe unpack002/out.upx
File Explorer
-
New Order.zip.zip 524KB
-
New Order.exe.exe 538KB
-
out.upx.exe 631KB
New Order.exe
- SHA256 15582393b01b6c64d16d7c573cec24dc00954c1faede0dc69777a1caa9757f7d
- MD5 fed5b3d1972774645a11685a33140e28
- SHA1 c9ea3cdc9f537fe50088c07c239c69dea4456ddc
- SHA512 5682fcc7f55a8915dceeda6ce0b6cb60f993987c2631c7b4024d6afc78cd94cc345561e59ac15df2fe9511a92736ef387354f703287ac1326d9da694ee269680
- SSDEEP 12288:V9BvctM85t35JPNJj2WzoRLQYRYzmYcwbzbpFMQWaJZpQEB52oSwc3:VD0tM85tbNJjldeYiYpi+so1c3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
756624
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
472KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
263KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=150, version=20413,
count=30, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=178, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=109, productName=VS2005 build 50727, version=50727,
count=33, id=123, productName=VS2005 build 50727, version=50727,
count=525, id=1, productName=Unmarked objects,
count=70, id=143, version=30729,
count=2, id=149, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
out.upx
- SHA256 3351dd65441b3d2f5a7db8377c57715f586730b2355c8c7de5f1b910357e9605
- MD5 4cfc336a1227bee3e8faa8c9c4d4064c
- SHA1 89d32b1c8a4fcdbae47c7094ec8bc3892776c180
- SHA512 ca3b31f4f6b3513aa33e0a8fb7fda04970ac9d81c6e36c6f58838a23908da1f4dc74e81f6fd1314255c22ca4ce3c307ca9cc305fb9c7e0e27f03625fdf14580f
- SSDEEP 6144:DBlzInco1bg7vxVLWnCA2h+uiSErK/3nQbjBZaK56A8iFKe4er6nF4mTDxWUaJY1:DLkcoxg7v3qnC11ErwIhh0F4qwUgUny
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
90896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
512KB
Virtual Size
512KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=150, version=20413,
count=30, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=178, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=109, productName=VS2005 build 50727, version=50727,
count=33, id=123, productName=VS2005 build 50727, version=50727,
count=525, id=1, productName=Unmarked objects,
count=70, id=143, version=30729,
count=2, id=149, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,