dc53cb79f81c98cb375e487798979d0e7bbb6b2cfa8fb908d42277a2b511151f
- SHA256 dc53cb79f81c98cb375e487798979d0e7bbb6b2cfa8fb908d42277a2b511151f
Behavioral task
behavioral1
Sample
SOA 20241224 - 2207.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target dc53cb79f81c98cb375e487798979d0e7bbb6b2cfa8fb908d42277a2b511151f
- Size 633KB
- Sample250702-ejrm5sej8y
- SHA256 dc53cb79f81c98cb375e487798979d0e7bbb6b2cfa8fb908d42277a2b511151f
- MD5 19da917ea54d39b4adad07cb5c045442
- SHA1 6e9f4e09f29f7ad3bb1b0e6b67a060076b7e6c5a
- SHA512 01925f8cf33229cd2c551ab336f7e59feeec9c6a477b94c82a59b352284497c1c3b230a902dad349e822bfe92e0888491d718ebec89d27a465a55be08fce31fb
- SSDEEP 12288:p2+1Hqft2xTqSonaJx0UPXJ71a3R7saFHPD954qtICLkkttf:4YHVxT0aMUPZxq7saRPbrLkkL
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/SOA 20241224 - 2207.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/SOA 20241224 - 2207.exe unpack002/out.upx
File Explorer
-
dc53cb79f81c98cb375e487798979d0e7bbb6b2cfa8fb908d42277a2b511151f.zip 633KB
-
SOA 20241224 - 2207.exe.exe 657KB
-
out.upx.exe 1.1MB
SOA 20241224 - 2207.exe
- SHA256 a0cb4caaa0e12b44876ff4178904c97616cb752541c3cfceb1a501507710cea2
- MD5 e9d7adee1ece193a4250a1b42165bece
- SHA1 8eabecb064f848332f3cbaf5c32a34a4a96cf5b0
- SHA512 37ff1821c05363a774b76faf68c6e80f3c62690f30a7500f942e65ea1466e341bca45cfcdbc06d4678f4662a43f72bc98fcf4c993de07054fc5664e20b71a703
- SSDEEP 12288:6z7hU5I5yuNHIgzSFKxWltRohBfSTso93U/62WsaFrPDt54qzICLkYtO:6f+iN57Gtene3TsahPTVLkYc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1230432
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
828KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
370KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
286KB
Virtual Size
288KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
out.upx
- SHA256 e279ae19906f3ff33824197d3577178d0cb0bb65768174874fd88487ecde15f4
- MD5 6e2cd13ce1c2108e039f8b8745ae9157
- SHA1 11e1f87551c3da2fe5d5586ece76427a002d7c77
- SHA512 eff0720c3c46eb8995661d473e763ba0cd958d8255c2096a37e6d0034d12aa5cd0bc489dff736588f0f69b6654e8209c48c8c1357db60c56f69b9dfc49c2c172
- SSDEEP 24576:t5EmXFtKaL4/oFe5T9yyXYfP1WAXbsahPTVLkYc:tPVt/LZeJbInI4ZpVLk
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
132343
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
619KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
293KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,