a0ee0e606891903dac59634c4e52a93ad453091b6bbf3a6d6edb3a3738e6ce0d
- SHA256 a0ee0e606891903dac59634c4e52a93ad453091b6bbf3a6d6edb3a3738e6ce0d
Behavioral task
behavioral1
Sample
微软系统直链下载V1.3.5.2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target a0ee0e606891903dac59634c4e52a93ad453091b6bbf3a6d6edb3a3738e6ce0d
- Size 435KB
- Sample260822-e514pseq5z
- SHA256 a0ee0e606891903dac59634c4e52a93ad453091b6bbf3a6d6edb3a3738e6ce0d
- MD5 52edad38bea1187c84e93f55f1d357c7
- SHA1 f8f31245960f090df5d4eb2f47f1c162491ad07e
- SHA512 fa505fe20286e34702214870f62512745b76398d1ca062f22a030f4c35b229a56d8d8f3874d102a59269f711f3d0751ea215926f129ed9681dd7638484dd13a7
- SSDEEP 12288:c6796SNATbpq/evYteU+oPr9js/QhZffqxJZL51:csIk/evHUlm/QhVozL51
- TLSH T147942370DF9803FB8993E50239EF7230122F49D1825DA7EABF7392D2394539496D2936
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/微软系统直链下载V1.3.5.2.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/微软系统直链下载V1.3.5.2.exe unpack002/out.upx
File Explorer
-
a0ee0e606891903dac59634c4e52a93ad453091b6bbf3a6d6edb3a3738e6ce0d.zip 435KB
-
微软系统直链下载V1.3.5.2.exe.exe 449KB
-
out.upx.exe 941KB
微软系统直链下载V1.3.5.2.exe
- SHA256 c683e75392629ed273d0a1a27ede7aed42618a7e5a3e6d452423f5791b293730
- MD5 c858ffaff6ceee32c1bdc794738b711a
- SHA1 15260ffa3f05db2436c4ddf7e9bd7fce20005bac
- SHA512 d5cd3b4103cd5d1a83804ece24aca1b472afc8ba28ff10de1b9e37255ef4d32ef979c5da50047e2815fac0ddb2002aae41da3f1e4c487d988a1ad1c931d75beb
- SSDEEP 12288:6sHzOUNUSB/o5LsI1uwajJ5yvv1l2klgpr:tiUmSB/o5d1ubcvPIr
- TLSH T186A42332B6C19C8DF01301B914F9D975D266D7A09EAA5FF70AD0E3DE48797E086026B1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1014480
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
588KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
399KB
Virtual Size
400KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
48KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
out.upx
- SHA256 d1cc770576aaf7713844a24b1d8b7187b0045e1a65d2219c863e2a3520a1321d
- MD5 711e8bfa9eb770c748c3eb4a105a547a
- SHA1 5bf37e2651e5c16899984aed6449fb692e19a880
- SHA512 5d5f1ce6a7718cc21f888ad270113f62984ded9c73ff59dd952db022743e52194b311dbea7ccecb72726410f473360086f4f364f4d78017af3c85f191d582d52
- SSDEEP 12288:SqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpre4Jdxmpr:SqDEvCTbMWu7rQYlBQcBiT6rp3dgr
- TLSH T12F25AF027381D062FF9B91334F9AF65157BC6A260123E66F13A81D79FE701B1173E6A2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
132471
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
619KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,