dba3b659e39c1f93c01d560f4cc080860afd2fc37d88e9a742a7a33ce58962ad
- SHA256 dba3b659e39c1f93c01d560f4cc080860afd2fc37d88e9a742a7a33ce58962ad
Behavioral task
behavioral1
Sample
Outstanding Invoices.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target dba3b659e39c1f93c01d560f4cc080860afd2fc37d88e9a742a7a33ce58962ad
- Size 889KB
- Sample251202-n2rwassjbx
- SHA256 dba3b659e39c1f93c01d560f4cc080860afd2fc37d88e9a742a7a33ce58962ad
- MD5 89aec1d52670180f9d5d1a597a20c7a5
- SHA1 14a7950267008071bd37dd06d237ee2c3af7b07e
- SHA512 8abcb7c9f74b24a5ba30cb147f9e754e89569e40c30a7a29e7460001d7cac05f8803726b00069fd65167a8c21e09c8135ffb7e331c235a54b2aeea61d167f93a
- SSDEEP 12288:8RMz1LT3M0w3yT93/stoNTJZB0KS3UdYiAaOTCsZxq45bIjoZi0CgHLuzGK55:8ynMs93/sto3ZB5sUdnyt8joC+Luq8
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/Outstanding Invoices.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Outstanding Invoices.exe unpack002/out.upx
File Explorer
-
dba3b659e39c1f93c01d560f4cc080860afd2fc37d88e9a742a7a33ce58962ad.rar 889KB
-
Outstanding Invoices.exe.exe 914KB
-
out.upx.exe 1.4MB
Outstanding Invoices.exe
- SHA256 82dcb4d2d2eea41de50b93c348a7850a4779e3e8f758c914605cb6f98a4a2be0
- MD5 9429f26944ee3f28df0508244beb6f6e
- SHA1 2c511974e4ad09c5fd0ababe6b176cb253c97c26
- SHA512 95f67bb394e5e8933612eebdf7cbe77e43314ae9a090b58fbdc9b3ba3ae3b31aa3f42e14596a526c81c39d7a0a4fc6145ca228c24ece61345d54931fe50aa0d2
- SSDEEP 24576:Of+iN57Gtene3eUSvQloOIQfYZ3qo+vuwJAzYc:YLXKtene3eUN9fwwoY6zY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1492704
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
370KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
542KB
Virtual Size
544KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
out.upx
- SHA256 43b97bd977711cfa63bb8ef3e4dfbcb41246033440f22f732f0931a95125253e
- MD5 c5a3f70fe42a63b88c4999fd56af49cd
- SHA1 ea2cd18137d44ae597f9395fc1ac59199b18d248
- SHA512 a6ab3a9286754586c08e956bd7e16c8dca83d9ed9a767377dbd3b198df7cebb0d65362a31778975195d7d22bc50f39551099ab3e92405d7c56a483d15457189f
- SSDEEP 24576:u5EmXFtKaL4/oFe5T9yyXYfP1WAXRSvQloOIQfYZ3qo+vuwJAzYc:uPVt/LZeJbInIgN9fwwoY6zY
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
132343
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
619KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
550KB
Virtual Size
549KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,