autorun.zip
- SHA256 3d207ecc4510ff55e8c87a4c2c17672e4d2c1c6a4c30b98dd384fbd9af69662e
Static task
static1
1 signatures
General
- Target autorun.zip
- Size 1.4MB
- Sample260629-f433caft2l
- SHA256 3d207ecc4510ff55e8c87a4c2c17672e4d2c1c6a4c30b98dd384fbd9af69662e
- MD5 acf37ae8082dfcf199d11a0bfbc77993
- SHA1 1db9a628496242baac5d908e907783ecdc63f46e
- SHA512 3c9b3acbbd15e451af8b5f89dd0c6128913d249f581fe46328030fc9093935f6c4dd64e610947fbc3c6b5367a149f2693dd043291bb8cf11d0cd6bd1750c85ed
- SSDEEP 24576:LaJFWsSmqRJRCA1G0ek4SoV3sMOORSS7EnogScOPgXv2/cY+jrDBpKNXNUmig:L+FW6q/71GG4XR/1BXgROVc3BWXN8g
- TLSH T12F653368DDBFC5D31FD885253F52AE2A03E720897A21C08855E25216675FFABCB33913
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/autorun/luacheck.exe
File Explorer
-
autorun.zip.zip 1.4MB
-
autorun/data.lua.js 723KB
-
autorun/logic.lua.js 430KB
-
autorun/luacheck.exe.exe 677KB
-
autorun/module.lua.js 202KB
-
autorun/runtime.lua.js 72KB
-
autorun/shared.lua1KB
-
autorun/sub 1.lua.js 359KB
-
autorun/system.lua.js 98KB
autorun/data.lua
- SHA256 b9d5db19afa3162a09b30ed0c8c155752efedade9eeba39e5af48fbe83259b8a
- MD5 889e7b64a19a6d7215369a0e80a5d6d1
- SHA1 f72791054660f4e43971ba947481f1cc293f1536
- SHA512 2aee61d431e24a0db9b200cdc4007f83bcd5b66320162f4519d8a2a0d235845626998eca0229bada1d49b8f5804cad8e5300776a81b6be42cc515f9c4cdff405
- SSDEEP 12288:/2qbu5r0nrllGTU8Kf7Stlqw8/+Q+07LEs0ITIytkfW+:+qbwr0nrl8TJMw8/+v0X0q+
- TLSH T19AF4D069501ABBAFD302EBEE5A566425F31509F6B0C40EEF2ACCB0FD39945408D28D7D
- MD5 SHA1 SHA512 SSDEEP TLSH
autorun/logic.lua
- SHA256 5a7742aee66d7027e772b9c661c6d1c24f7dfdf3cca44d2bf9b8a5b2a9ba737c
- MD5 c4cf4a55f9f5a0da73d71557dee30f46
- SHA1 e825877960810ef1c148f0ee2c05128832642417
- SHA512 bdcb67ed33e9378be0074f9b74a43e5ef51661eba9337244759380b8fa450d5f1efb720a78dc999efe0ff23bdfe8fd05cdb1bd96b06d049713bdea8771910aec
- SSDEEP 6144:I4kbpCzgWtSESNP2PzRiISqcuR9N8k1zgqiqUMwwardMK3zYlKc16VkHFmZk:CtdESNPuzRi3vuOkRgqt2iizYlKMYZk
- TLSH T10C94BFACE1BE6B982E07A6A0F03B04895F7D7C25F05F7A1E4815F1322DB1C796436798
- MD5 SHA1 SHA512 SSDEEP TLSH
autorun/luacheck.exe
- IMPHASH abcf74ebe8a3f2490d945dc403cbf2f5
- SHA256 f1395a3fac181094a3df500cf81698d1256638fab60f6e02994e9b0b1905fcdc
- MD5 2f2be86c84a3c6e87627b1a35e05da2e
- SHA1 a9f5ff86e161399a4484e191d8db2ff39673759b
- SHA512 30277d67c6d1a8e5175e4231eb80410ffdcc6631a3c92cad6d73900c692f640d40a6c7952f8068053cf9f5b5db7ae5d88941bd73f5f2d55385a8e883f624f9cb
- SSDEEP 12288:HAdRImh+R8fCPFfLEkzvpBRmXdCoukRTxlx/L5FwAbh1pOf6ZEbw8rOYk+8U:GRImMR8fCPhbdBs1TT3x/LrZbh1pOf6C
- TLSH T146E4090FB5521A79C793D4B499DB5622BA74B013130828B976DC83A42F14E6C93FBB7C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateEventA
CreateFileA
CreateMutexA
DeleteCriticalSection
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
MultiByteToWideChar
QueryPerformanceCounter
ReleaseMutex
ResetEvent
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetEvent
SetThreadPriority
SetUnhandledExceptionFilter
SignalObjectAndWait
Sleep
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
__C_specific_handler
___lc_codepage_func
__dllonexit
__getmainargs
__initenv
__iob_func
__lconv_init
__mb_cur_max
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_chdir
_cprintf
_errno
_exit
_fileno
_findclose
_findfirst64
_fmode
_getcwd
_gmtime64
_initterm
_localtime64
_lock
_locking
_mkdir
_mktime64
_onexit
_pclose
_popen
_rmdir
_setjmp
_setmode
_stat64
_time64
_unlock
_utime64
abort
acos
asin
calloc
clearerr
clock
cosh
exit
fclose
feof
ferror
fflush
fgets
fopen
fprintf
fputc
fputs
fread
free
freopen
frexp
fseek
ftell
fwprintf
fwrite
getc
getenv
isalnum
isalpha
iscntrl
isgraph
islower
ispunct
isspace
isupper
isxdigit
localeconv
log10
malloc
memchr
memcmp
memcpy
memset
raise
rand
realloc
remove
rename
setlocale
setvbuf
signal
sinh
sprintf
srand
strchr
strcmp
strcoll
strcpy
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
system
tan
tanh
tmpfile
tmpnam
tolower
toupper
ungetc
vfprintf
wcscpy
wcslen
_snwprintf
_findnext64
longjmp
user32
MessageBoxW
luaG_newdeepuserdata
luaG_pushdeepversion
luaG_todeep
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_buffinitsize
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_checkversion_
luaL_error
luaL_execresult
luaL_fileresult
luaL_getmetafield
luaL_getsubtable
luaL_gsub
luaL_len
luaL_loadbufferx
luaL_loadfilex
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffsize
luaL_pushresult
luaL_pushresultsize
luaL_ref
luaL_requiref
luaL_setfuncs
luaL_setmetatable
luaL_testudata
luaL_tolstring
luaL_traceback
luaL_unref
luaL_where
lua_absindex
lua_arith
lua_atpanic
lua_callk
lua_checkstack
lua_close
lua_compare
lua_concat
lua_copy
lua_createtable
lua_dump
lua_error
lua_gc
lua_getallocf
lua_getfield
lua_getglobal
lua_gethook
lua_gethookcount
lua_gethookmask
lua_geti
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_getuservalue
lua_iscfunction
lua_isinteger
lua_isnumber
lua_isstring
lua_isuserdata
lua_isyieldable
lua_len
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_pcallk
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawgetp
lua_rawlen
lua_rawset
lua_rawseti
lua_rawsetp
lua_resume
lua_rotate
lua_setallocf
lua_setfield
lua_setglobal
lua_sethook
lua_seti
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_setuservalue
lua_status
lua_stringtonumber
lua_toboolean
lua_tocfunction
lua_tointegerx
lua_tolstring
lua_tonumberx
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_upvalueid
lua_upvaluejoin
lua_version
lua_xmove
lua_yieldk
luaopen_base
luaopen_bit32
luaopen_coroutine
luaopen_debug
luaopen_io
luaopen_lanes_core
luaopen_lanes_embedded
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table
luaopen_utf8
Name
.text
Size
236KB
Virtual Size
236KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
592B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
403KB
Virtual Size
403KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
autorun/module.lua
- SHA256 58963d967a990eee4ad4b0f2e20b5b2e57a54128c4867377951b709fac41f957
- MD5 9a92a2c818edeb0a2d6856c54f8cd86d
- SHA1 9a67cd9b4b8c6d06d2210b1de3edc7ef6760a151
- SHA512 6ef8ed4548a83c318e9d374c8f2064830b9ea6c7e770f1a953ff502b0885eba8647c07cab1791d52466cb4c5fba89fe41c4420b6d6b3c78dc7a601ecdb87a24e
- SSDEEP 6144:B8pO6LzjxUyH1zgzEihK2M8R63Z8bzH4ihsp32:uDmyKEihKGEihl
- TLSH T152148D9C718E3761B353B6F08AAB4879579709E29D0E1D6EC098F270381D24FC7A9F64
- MD5 SHA1 SHA512 SSDEEP TLSH
autorun/runtime.lua
- SHA256 2c3d121c8da001d3192772a8e237c48a57b3f170aed4cc747bb84319d40fb044
- MD5 627fb3d41f8823ace53dacd85b2a7f59
- SHA1 dfce8aa1bf56d25b94231cacb850cf78f35f3058
- SHA512 6ac0beb61c57ed2ae07b11271eb4db6f0f21a8da8f249cd21433af3b0f9b935267a271a46ea50716eb6234be88fc71d29108354f00a3eff82ef6bcef93cc3973
- SSDEEP 1536:cB5W0h/LQFlTc+Sut40pamKP7oPPWm2/4B+Q9kUFvsvTB:cB5Wy/0++Su/aPUPPWmuW/E
- TLSH T15073E8CD32AA73E1A337B6E4986B2856D75A1C32441F0A1F4088F2B4F94A56DC43DF79
- MD5 SHA1 SHA512 SSDEEP TLSH
autorun/shared.lua
- SHA256 16ad7f874292926bf5212d6a0e3653bd582537b904fe2897a2832ea61ea0ddd4
- MD5 501fa33e232c7440ff558e8cba12fe79
- SHA1 d684148f607d11471d5d1ada68d4737b9e796be5
- SHA512 3ee9951d7a15b7df77f8036c57dda58504c16818f9704650607688d191d407473d49989f8c2f52c7cdc45fde3e1c7698375ced9c2ccdee2dbf7245fcd4f79774
- TLSH T1A231C09F7257296363C3B2668A935400B125BA23434D4955FA9C41E87F60A3EC3F3BB9
- MD5 SHA1 SHA512 TLSH
autorun/sub 1.lua
- SHA256 cb2b1e2cd4c00ba7f6934d52b91c2340db4081dbb2a6de2e44a2319ac2bd7156
- MD5 e33b81762bbd6d42ef614fad6209315c
- SHA1 2d8e12bc7a4ad57fafaf989627349cc2b4529539
- SHA512 42d686817f2d0eea4a4462800164e4b3608f91fc670a215e8ea96eb332e97e3b05011d87c8c7a0b3baf6cdf8d905bd320c2ad14f763837eb69e80bab79c2f126
- SSDEEP 6144:h9mds6S++pcIW5M/yxKM4529ueo1kmNJgxNnbaf0kWIuMjpf+Xy:adsQ+up/U1TQnbFc
- TLSH T15A74C0DD706E9B82F353F5E8641F481ED721943747AE0A2F01E4F17CB852E0AC1A9EA5
- MD5 SHA1 SHA512 SSDEEP TLSH
autorun/system.lua
- SHA256 9e706a2d1ae23851cc7fb6dbec0f2bdeacddcd07e124cc02de2dec6ba12e7def
- MD5 bf70dcee81a1aab3863df3cea5b02bf9
- SHA1 912047327ca9fe138523b2625983891c1679c694
- SHA512 11d82edf98dedd2154a8627195f5458b84869ab65bf8b693fbb666b2ac756ab403e3ece33a1a9771af0a452857cec62e2473cfec4c1e642c4733b7282df91800
- SSDEEP 1536:STCzlcGTqVQEgY3o+BRi/zqT8upyVY7c5mdzO1tlB7CebxEnA:St6qVQ+3oMA/zqQupZIQO1tWe9
- TLSH T111A34ADE329E7390A716B1E2C92B0459AF5A0832414F260F41ADF378BA1631FD439F79
- MD5 SHA1 SHA512 SSDEEP TLSH