5bbb47b9c39d5de55643fdd07ef00cbe8ec3e6d0c87f4f467ba1411b73f88365
- SHA256 5bbb47b9c39d5de55643fdd07ef00cbe8ec3e6d0c87f4f467ba1411b73f88365
Behavioral task
behavioral1
Sample
MT103 SWIFT COPY.exe
Resource
win7-20241010-en
windows7-x64
24 signatures
150 seconds
General
- Target 5bbb47b9c39d5de55643fdd07ef00cbe8ec3e6d0c87f4f467ba1411b73f88365
- Size 828KB
- Sample241108-rmcplssqev
- SHA256 5bbb47b9c39d5de55643fdd07ef00cbe8ec3e6d0c87f4f467ba1411b73f88365
- MD5 510b39f53f77adb741328bff3f5e8327
- SHA1 a68d12543d975711684317dcf94269ef56c2539f
- SHA512 13464478211670153e7f5312fa9b6d4d99208f98f50f0bd9574c2c8a3ff808d873d48d6e9aad8e650b6feaee0828465e601f3410d12ef5512285058b3589bb4f
- SSDEEP 12288:J/gBT51V14eECqni+OaGtEBjOU6w7WnBSoZ1o78zFDS6Lle1HCimNbRa/nXmO:FgBTS7ntQWBjOVy7+DS6U1HCiaE3
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/MT103 SWIFT COPY.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/MT103 SWIFT COPY.exe unpack002/out.upx
File Explorer
-
5bbb47b9c39d5de55643fdd07ef00cbe8ec3e6d0c87f4f467ba1411b73f88365.zip 828KB
-
MT103 SWIFT COPY.exe.exe 843KB
-
out.upx.exe 634KB
MT103 SWIFT COPY.exe
- SHA256 38bc8e7a5591373c9e2e798a86e78d5435b9262a69b693e67257c48ef167c9ce
- MD5 ad206d63011b84720546b1eeb4cbe33f
- SHA1 26958fb991f1fbbd19f6b68bd8e797b9466d7eee
- SHA512 e9e6e7de1dbb424be813b93fadaa1a1eceb9e2e542485ea5a16c00b2be6178f3ffb7845ed332c622c22c13c21311a2be5a38de11031f793cffb083c6c3ac6f03
- SSDEEP 12288:v6Wq4aaE6KwyF5L0Y2D1PqL9ovRjKUSi7WnLSoDbon81FDy6Lly1/qikNBRa/nAa:tthEVaPqL9ajKF4n+Dy6M1/qi4ba
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
757360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
472KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
264KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 fcdf46fc4db849adf0b4127317d2bbc86ab9d00d1756095f7d0f98f835276c2a
- MD5 d67ea5285c3c56c6fdc8f2a28354bd44
- SHA1 53350bfe1a1c7b668cd42bc7c1eddc4383875b85
- SHA512 6e2c876f5102336c6ff825ecd4319bc1fb2a2343b04606d60d9640fc0c1baf3f2be1d0b3f37dd5d40d9e4df49c8299322fbc97e9b4f9f50dbcbd71f700ce16d1
- SSDEEP 12288:WhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJc:GRmJkcoQricOIQxiZY1
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
91585
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
514KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,