22112024_0124_20112024_FACTURA09876567000.ziP
- SHA256 ba934973bca1c75b9bc1aa5a24e7f9dda6e65b9edbe2aacf6c763ba7b0f4d79b
Password
infected
Behavioral task
behavioral1
Sample
FACTURA09876567000.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
300 seconds
General
- Target 22112024_0124_20112024_FACTURA09876567000.ziP
- Size 481KB
- Sample241122-bsehds1ncy
- SHA256 ba934973bca1c75b9bc1aa5a24e7f9dda6e65b9edbe2aacf6c763ba7b0f4d79b
- MD5 471785b0e509d7758c27e9af0f5c6ea1
- SHA1 ef1ad64e8e472fc687eec6feb70d08c2f4407c9a
- SHA512 d71f03cf210d00f1953372583ddb02de66e2781ad3f0816c47a50ce3abc2ed800c641cba36033049021321901ba13fa0b7f797bb0f8a4c5ba7c74169b4cfba58
- SSDEEP 12288:u92YbpwUSaQz7C0qvRAnoIzQlYAWXozVnpPNlZjW:MlS3SRC+WMPNlZjW
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/FACTURA09876567000.bat upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/FACTURA09876567000.bat unpack002/out.upx
File Explorer
-
22112024_0124_20112024_FACTURA09876567000.ziP.zip 481KB
-
FACTURA09876567000.bat.exe 506KB
-
out.upx.exe 980KB
FACTURA09876567000.bat
- SHA256 ecc61fe635e2cdb0859441ef90e330230094e7514cf00cb48829e136d713b63b
- MD5 f4a43c4e63d1bc8908819fc2b3b6a83b
- SHA1 03f88667ac44a41a2b5e4b2cf48f23302ae79b6c
- SHA512 6f1ce342403bc33f5dabfa0260da8f45bfd6d3bdfe72df20e0a617f71bf2abe926a29393d4a9e4621ee8a5ade029c20ed025fe377ab7c1d6f954f866c1efe76f
- SSDEEP 12288:FOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi0Q/mXWb0zjnfxNNZjXO:Fq5TfcdHj4fmbjQOXQ0xNNZjXO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
1056592
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
692KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
336KB
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
168KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=199, version=41118,
count=51, id=205, version=50929,
count=174, id=206, version=50929,
count=50, id=207, version=50929,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=532, id=1, productName=Unmarked objects,
count=77, id=216, version=61030,
count=2, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
out.upx
- SHA256 c307347ac47189c6ca8b20e96e92584bc86e5e128fb99cd123b433950c391eb6
- MD5 207997b400d5f21c4a14d744e21faded
- SHA1 ad19ce46206f54b873cb30bd4e75b04e7d20658f
- SHA512 89d81dcc0d9cb8d65f7f1948a3751553c0dd7ad6fdcd126ac68d70a396a42885593204ea526e0200bbccea0659b0ec656fac51ca4f96432d3da2b4fbb0d29ceb
- SSDEEP 12288:Itb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNxPPpHVmXWb0zjnfxNNZjXO:Itb20pkaCqT5TBWgN5CXQ0xNNZjXO
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
155508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
557KB
Virtual Size
557KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
179KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
176KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=51, id=205, version=50929,
count=174, id=206, version=50929,
count=50, id=207, version=50929,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=532, id=1, productName=Unmarked objects,
count=77, id=216, version=61030,
count=2, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,