8855ef55076566f0a90f36a1bdad52c28388ff9e6dc599e117b7cfc68c2f9507
- SHA256 8855ef55076566f0a90f36a1bdad52c28388ff9e6dc599e117b7cfc68c2f9507
Behavioral task
behavioral1
Sample
payment confirmation.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
- Target 8855ef55076566f0a90f36a1bdad52c28388ff9e6dc599e117b7cfc68c2f9507
- Size 858KB
- Sample241111-c8vd8atrhl
- SHA256 8855ef55076566f0a90f36a1bdad52c28388ff9e6dc599e117b7cfc68c2f9507
- MD5 e53c224cfc4e44d9ee530887e651b99b
- SHA1 2ad901d2166ec55731e940a275c2d842dc471eab
- SHA512 41fb500f8dc31ff80354d54059b74b900ee840a2b3422313d75d62b7a5f003de6a63b7c669a020518af4e4d9f407f4ab4429e2e043c65f63500df70d059e2f06
- SSDEEP 12288:PYOWW2tE3dKP+V32LHwoWJo7SA/j9Org1MC4XCp1PBXATjIw3dL4UPUP5KtqAqu+:PYO2+mn2JoN7Ggy8FAj3RdbcOf3jjOJV
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/payment confirmation.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/payment confirmation.exe unpack002/out.upx
File Explorer
-
8855ef55076566f0a90f36a1bdad52c28388ff9e6dc599e117b7cfc68c2f9507.zip 858KB
-
payment confirmation.exe.exe 926KB
-
out.upx.exe 1.4MB
payment confirmation.exe
- SHA256 cb62c5a32d65e57b523d60844334f410be45956464553dabade26b62182df4af
- MD5 70113c7be193321950485142c8791a7c
- SHA1 95310aa0c9e5ccc3e5fdd001df09653889c33b63
- SHA512 9708c2c2056b00b5bf43af014534354fe839b22f2353563e961da9b4d487cedd6fbb49f325e60e863b81ceeda8a40236f149ceee03f268b3196baae8b971a0ed
- SSDEEP 24576:nf+iN57Gtene3YSySHurVZBDSGfPNZqJ4:fLXKtene3YSjuhzfVZqJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1505024
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
370KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
555KB
Virtual Size
556KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
out.upx
- SHA256 cfcfe60844bfb2788d43b9a9ef9e228d5a4535e7df50094260513f6f88f9d8d8
- MD5 5168f12a7078d8f3e7d71c4e566e3e11
- SHA1 19ab51abe55b1d3e695f6b1bfca8990ba315e72a
- SHA512 03a7286125eff1d648f42f01b0bb15ff48d77379368b01e4a4b0c828e06460812649e4d42a4171f13eea1320cb02de027c9eca46253e6401a1487726c69736a4
- SSDEEP 24576:05EmXFtKaL4/oFe5T9yyXYfP1WAXSySHurVZBDSGfPNZqJ4:0PVt/LZeJbInIjjuhzfVZqJ
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
132343
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
619KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
563KB
Virtual Size
562KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,