Behavioral task
behavioral1
Sample
b5aa56b1df29b386fdc8ab5b37b5c9b6d82ce07ada2d7dfa72e032ed85bc4989.exe
Resource
win7-20241010-en
General
-
Target
8a968e412a3f5212e36a69d429dc0a2be143e70ad6ffe7c2b4a9bb4ab19ca045
-
Size
561KB
-
MD5
6bbea0774716cb99abe78cf55fb69c71
-
SHA1
acb158639605ebef5016a58bc2e651783a977098
-
SHA256
8a968e412a3f5212e36a69d429dc0a2be143e70ad6ffe7c2b4a9bb4ab19ca045
-
SHA512
902c480638e45017e5bac0cbd7da084744113c2b9c88a58b7fbb58d6ceca847bad69e34485ac5f937136eeaadfc74907f3099de73c7cf80411b2c9aee5b53740
-
SSDEEP
12288:rb1U/iCsDKMwZsfOOhJC3h4Q9VaOtFG5KMN4ZHGbS1khy:r5Ua1DK/smOhJohrG5BN4Z11Ky
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/b5aa56b1df29b386fdc8ab5b37b5c9b6d82ce07ada2d7dfa72e032ed85bc4989 upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/b5aa56b1df29b386fdc8ab5b37b5c9b6d82ce07ada2d7dfa72e032ed85bc4989 unpack002/out.upx
Files
-
8a968e412a3f5212e36a69d429dc0a2be143e70ad6ffe7c2b4a9bb4ab19ca045.zip
Password: infected
-
b5aa56b1df29b386fdc8ab5b37b5c9b6d82ce07ada2d7dfa72e032ed85bc4989.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 768KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 337KB - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 247KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 560KB - Virtual size: 559KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 255KB - Virtual size: 254KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ