fatura.zip
- SHA256 379e6c5ebde139b6ccf96a6ece6b8a24b74368dcb787e898ff4c593e76093e02
Behavioral task
behavioral1
Sample
fatura.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
fatura.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target fatura.zip
- Size 906KB
- Sample241108-smwcdsvbkb
- SHA256 379e6c5ebde139b6ccf96a6ece6b8a24b74368dcb787e898ff4c593e76093e02
- MD5 8311ecb1c18c00aa63fa2f890933b858
- SHA1 3f249b673ea77a1ac4530f6e0e404ad7814edb70
- SHA512 433b575ed0afa04e31209d91424bb2435dc99fc6c38100d40e86fcc4985c0a29b517c4748961f294f894c9d7c4df638974eaa232b106c1150a6042d6a77742ec
- SSDEEP 24576:wv8zCuG8DJSfrnsHLIIDiAcBM0CCwSncSs+0:g8OoDJSf6bfcCdXqc3
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack003/out.upx autoit_exe -
resource yara_rule static1/unpack002/fatura.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/fatura.exe unpack003/out.upx
File Explorer
-
fatura.zip.zip 906KB
-
fatura.rar.rar 905KB
-
fatura.exe.exe 929KB
-
out.upx.exe 1.4MB
fatura.rar
- SHA256 9631c9c5e462ad39703479dee4f39d44409da1b67e7d792470027a0901623526
- MD5 7494e23a94139b2e7a8ab11bb7ddacbc
- SHA1 ddfcfce8204d9ed081a0ddf7e851073a6cedd488
- SHA512 f7cdd765155ebbe6a1e9582746bb330ec6e754e319020bf0d65bd325de2b445800c308e0c5f10a139fd3434bc665838e8ac833dfa62d9e607fabbeb36be47c2b
- SSDEEP 24576:Yv8zMu48Nnehxn05Lc4DiM0NySqCSKnY6C+U:I8goNneh8Nz0QlpSYL
- MD5 SHA1 SHA512 SSDEEP
fatura.exe
- SHA256 ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903
- MD5 49e9e776c6f5d00a090adbd8814ffdc7
- SHA1 4ea5b8d7b7beb2ad75bbe583c4658093c4ab12bd
- SHA512 06e761bafcf3aa68a739ec24f17db1f9d1a36f59b940c8de12fd388dbd871dd2ab443a60c7723cd77ec1f52859cef469d9493759acc8acc1cfe1c471bf06f8cd
- SSDEEP 24576:L4GHnhIzOa5WPGzwQA+jLgNK5O5Y1fmdruuAF:0shdaYP3t+g3d
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1481328
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
343KB
Virtual Size
344KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
584KB
Virtual Size
588KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
out.upx
- SHA256 e8fa5f4fdabb762edcfb5c3acf18b7ca0d435b3f97f445d7629693276298fcac
- MD5 5eddcbe95b7095e74dcc14b5e38907a0
- SHA1 898125d991b1cd719e16fb29fb05f615716fa31c
- SHA512 66b4e0fda899cecb2bd146a1063ba5677ff1a5cc04dc39a85912934ade2760e5693f276096e289834b77be272573a0092abfaf933bc45bafd90fa73dce088d40
- SSDEEP 24576:SCdxte/80jYLT3U1jfwOWPGzwQA+jLgNK5O5Y1fmdruuAF:Dw80cTsjYHP3t+g3d
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
163658
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
567KB
Virtual Size
567KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
184KB
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
592KB
Virtual Size
591KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,