Behavioral task
behavioral1
Sample
78ba167393b90253983058b4b3456dc65d3bb07d10bc61c70e5b4f5d5d43ad96.exe
Resource
win7-20240903-en
General
-
Target
78ba167393b90253983058b4b3456dc65d3bb07d10bc61c70e5b4f5d5d43ad96
-
Size
649KB
-
MD5
63abd958f823c530adf43b1bb352682b
-
SHA1
1c1e62524bab0ae93b5cacc96c6131d7ae807668
-
SHA256
78ba167393b90253983058b4b3456dc65d3bb07d10bc61c70e5b4f5d5d43ad96
-
SHA512
20e39b473d83aa25c2cb420f73577b49ea11569833315051bcab140e51b7a01ca749b33c33bbae797e5dfb5c8d549e6204f49a8b2c3983bb3dba9b7e1b5201db
-
SSDEEP
12288:POv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPifUcTb1x7uA/bJUkpaY1:Pq5TfcdHj4fmbsUmO8JUO1
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/out.upx autoit_exe -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 78ba167393b90253983058b4b3456dc65d3bb07d10bc61c70e5b4f5d5d43ad96 unpack001/out.upx
Files
-
78ba167393b90253983058b4b3456dc65d3bb07d10bc61c70e5b4f5d5d43ad96.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 836KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 336KB - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 311KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 557KB - Virtual size: 557KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 179KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 319KB - Virtual size: 318KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ