PO 250574.zip
- SHA256 20aaf8d44238dfdc2e22c6560fd89dac4dabdf9345d432590885ede97913dedb
Behavioral task
behavioral1
Sample
PO 250574.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target PO 250574.zip
- Size 668KB
- Sample251114-pqrltswpfp
- SHA256 20aaf8d44238dfdc2e22c6560fd89dac4dabdf9345d432590885ede97913dedb
- MD5 5aba4fd043149a95b25c144a6b93659a
- SHA1 b8312726b59176ea94a6108856967b70af56a715
- SHA512 9131f2a9e056a976f32bf35edd1dcb603cc1f7b0fae82a9d4cfff0318c90517426aa46ce7ca7fdebb573a1ff2d18b48aae2f26d0ab008756b474a09cd704808d
- SSDEEP 12288:RQafDSfRgTqttzaBBEKDPx8Eu0BO+0AXwl48zGJAgDRQlvK52azFm:CafutrKDPuEG+0Agl3GdDRn52az4
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/PO 250574.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/PO 250574.exe unpack002/out.upx
File Explorer
-
PO 250574.zip.zip 668KB
-
PO 250574.exe.exe 692KB
-
out.upx.exe 1.1MB
PO 250574.exe
- SHA256 a261dd696014b1ee8348bef04980efda5d762a6563a08c0256d5f09fec1a8cd7
- MD5 0384a7d1cd538445271c4940818a7b7e
- SHA1 3e73abb05b65b135b104fdfd8a3e3112b214d863
- SHA512 478dd0c3ef0ab881ed23edc9433204210a6f1ad06a80169b01b8db6906e9282dbcf63436df87fe2b73e86e1139ec122e1707d02b76921bf1f7b30241c02b23b1
- SSDEEP 12288:xOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiwce+x48ZMJAgFRa/v092azLP:xq5TfcdHj4fmbVMFMdFRB92azr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1249168
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
880KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
336KB
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
355KB
Virtual Size
356KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=199, version=41118,
count=51, id=205, version=50929,
count=174, id=206, version=50929,
count=50, id=207, version=50929,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=532, id=1, productName=Unmarked objects,
count=77, id=216, version=61030,
count=2, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
out.upx
- SHA256 6db9b650a34155ed2606e6f93863982f22ba9d9090e877f043f1cd97dbb1cdc5
- MD5 fa90b517ae90e77bc7e89ea8608494bb
- SHA1 e0424494ed5cfff0802a743862cf01336bc8d5e3
- SHA512 fc1072bd7f48bd8ef8cf0aeb8eb7f41df814c267c5df5e1b0b37a6a5aea3094ac65ba5d7e6cdd9029e1ab7a2097a69351dd2f1850855d3f27a9420347b35084c
- SSDEEP 12288:Itb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNxPPpHFe+x48ZMJAgFRa/v092azr:Itb20pkaCqT5TBWgN5nFMdFRB92azr
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
155508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
557KB
Virtual Size
557KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
179KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
362KB
Virtual Size
362KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=51, id=205, version=50929,
count=174, id=206, version=50929,
count=50, id=207, version=50929,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=532, id=1, productName=Unmarked objects,
count=77, id=216, version=61030,
count=2, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,