8c60bce2ff51acf644ecb793eab5d2bdcd112d7b2ccd2a17f43b01af11ad9b1f
- SHA256 8c60bce2ff51acf644ecb793eab5d2bdcd112d7b2ccd2a17f43b01af11ad9b1f
Behavioral task
behavioral1
Sample
DOCS 8PACKAGES-390KGS/DOCS 8PACKAGES-390KGS.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 8c60bce2ff51acf644ecb793eab5d2bdcd112d7b2ccd2a17f43b01af11ad9b1f
- Size 813KB
- Sample260813-ysw4rseq7s
- SHA256 8c60bce2ff51acf644ecb793eab5d2bdcd112d7b2ccd2a17f43b01af11ad9b1f
- MD5 6e4b353bef0b7c8a0981a6c5d750df9f
- SHA1 de0ff9351f974d645fce79fea2bcfb76461efd7c
- SHA512 b6dafb25c2908126f0a40f838ae1164905cb56dcc1102baa3288d1d2ed40a92c5a20c88ec6d4a9c24f42509a35ee65b3fae7f324815aeee48eecc1f21ac69d30
- SSDEEP 12288:XuqUQCQR67hnaQu9y2EV6nUu5PPhYt4eDVY+NVr59ZoT4b0wx+/gcu59CV:Xuwoa9w2861HG4uVXVr53onnyk
- TLSH T19C0533CE7383D1CFEBF418BD4F50699E3649188EE834AC69D40F790806F99716369A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/DOCS 8PACKAGES-390KGS/DOCS 8PACKAGES-390KGS.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/DOCS 8PACKAGES-390KGS/DOCS 8PACKAGES-390KGS.exe unpack002/out.upx
File Explorer
-
8c60bce2ff51acf644ecb793eab5d2bdcd112d7b2ccd2a17f43b01af11ad9b1f.zip 813KB
-
DOCS 8PACKAGES-390KGS/DOCS 8PACKAGES-390KGS.exe.exe 1.1MB
-
out.upx.exe 1.6MB
DOCS 8PACKAGES-390KGS/DOCS 8PACKAGES-390KGS.exe
- SHA256 0711a52ce8bfd5201b82f639f5d62e112db7c431866ae6998495d0e36a1c8cbb
- MD5 37e844ba9ce728a2e2a5d7d2e7545b2e
- SHA1 459c992573ca7a34e2c79bae06f4727bcb99eef7
- SHA512 e2bd37c7847ada01eb1a9fdc0ffffc29ecf8d2f38ed2adff665cf16d3414b6714d9c8c4a2d4690647d7e787607f04b61fc46f46b64667ebe3f2e70c795d5b1ad
- SSDEEP 12288:Iz7hU5I5yuNHIgzSFKxWltRohBfSTso93Uobvqz4eDTY+LNr59FWT4b0Ax+lgSuz:If+iN57Gtene3Hbvqz4uTFNr5fWbVY
- TLSH T1A745E0027345DF55C52F14B6C9A2C6F81327BE00DC059BDB76D9FE1A39F22EA6A61083
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1754992
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
371KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
798KB
Virtual Size
800KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
out.upx
- SHA256 875a235f888885e3e294d24d6484f7da966e480a879b69937689bee723eca41d
- MD5 1b4082db390b0ea4f8eff75d36b2da21
- SHA1 17e4e8241c0edf134a5ec7b0f4aa62c3c856fbcb
- SHA512 ed92abda3bd6f6d58be9839be0575a6e3a8c32ac8b518d5efb1e9eeccde0f0c8e0fd62241d78d8c3ab8e9d79a8fcad946acf7b86f821b26a447c09ee99e2aedc
- SSDEEP 24576:V5EmXFtKaL4/oFe5T9yyXYfP1WAX2z4uTFNr5fWbVY:VPVt/LZeJbInI3tFNdfi
- TLSH T135759D023381CF22FE5F5072CA96E2F1577B6E15CD13A7DF22983D39B9B01A1162A593
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
132343
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
619KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
805KB
Virtual Size
805KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,