30ad75174fd1f31064b3ee61e463aa1c129c7da79ac25ef282f0751a754c6056

General

Target
30ad75174fd1f31064b3ee61e463aa1c129c7da79ac25ef282f0751a754c6056
Size 6.9MB
Sample260910-para5abq4x
SHA256 30ad75174fd1f31064b3ee61e463aa1c129c7da79ac25ef282f0751a754c6056
MD5 9140cbc86f7c412ccdd3a7a7ce78b58e
SHA1 ba512149aa8faac7ac6b7d2ce4cc3bcc0f46e7df
SHA512 180a2487c37245ff61474874bd7885f618e37824030ac8b7f91cf3fbd0043d7eb7f06dd935422094508efae8e1391a0566d1030ccb41c07af072315b8c18e14d
SSDEEP 98304:OKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUxEK:OquFIF0wuPlCKrjRvh
TLSH
T1EA76AE0273D85475F1B3163199759229663ABCA58F32CA9F328C2D5E7FB16808E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30ad75174fd1f31064b3ee61e463aa1c129c7da79ac25ef282f0751a754c6056

File Explorer

30ad75174fd1f31064b3ee61e463aa1c129c7da79ac25ef282f0751a754c6056

.exe 6.9MB

30ad75174fd1f31064b3ee61e463aa1c129c7da79ac25ef282f0751a754c6056

IMPHASH ad2258898f0fbdcaaa6098836dd9129f
SHA256 30ad75174fd1f31064b3ee61e463aa1c129c7da79ac25ef282f0751a754c6056
MD5 9140cbc86f7c412ccdd3a7a7ce78b58e
SHA1 ba512149aa8faac7ac6b7d2ce4cc3bcc0f46e7df
SHA512 180a2487c37245ff61474874bd7885f618e37824030ac8b7f91cf3fbd0043d7eb7f06dd935422094508efae8e1391a0566d1030ccb41c07af072315b8c18e14d
SSDEEP 98304:OKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUxEK:OquFIF0wuPlCKrjRvh
TLSH
T1EA76AE0273D85475F1B3163199759229663ABCA58F32CA9F328C2D5E7FB16808E39733
MD5 SHA1 SHA512 SSDEEP TLSH

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

17932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\w64.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject FreeLibrary CreateProcessW SetHandleInformation WaitForSingleObjectEx AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar GetStartupInfoW GetTempPathW CreateJobObjectA GetStdHandle GetLastError GetProcAddress SetStdHandle LoadLibraryA GetFileType SetConsoleCtrlHandler SetCurrentDirectoryW CloseHandle GetProcessHeap SetEndOfFile SetEnvironmentVariableW CompareStringW FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc GetModuleHandleW DecodePointer HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EncodePointer TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount GetCommandLineA RtlUnwindEx DeleteCriticalSection LoadLibraryW FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc WriteFile HeapSetInformation GetVersion HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount Sleep LCMapStringW ReadFile SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CreateFileW HeapSize WriteConsoleW

user32

PostMessageW WaitForInputIdle PeekMessageW CreateWindowExW GetMessageW DestroyWindow

shlwapi

PathCombineW StrStrIW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

30ad75174fd1f31064b3ee61e463aa1c129c7da79ac25ef282f0751a754c6056

kernel32

user32

shlwapi

generic