23de5d49da36dc0d22de576aadfc84f04c103893ab9e1afa83252e90be412a78

General

Target
23de5d49da36dc0d22de576aadfc84f04c103893ab9e1afa83252e90be412a78
Size 9.6MB
Sample260916-16pb7a1s5p
SHA256 23de5d49da36dc0d22de576aadfc84f04c103893ab9e1afa83252e90be412a78
MD5 f420b85867e766a5faf076981632bec8
SHA1 a5500e0edab36e10875f695fd7b09b3c8c22093d
SHA512 ae2aec8741b1b382b222bfe477efafbc6d43a9d9707be6752dd716d6e49b88880d834df55c2169abbc3ab142824f95f15b5fe7670595e19a407aeb337179c61a
SSDEEP 196608:PU/jCtsCKgKWQc0gEYnvLkKC2C+CU/jCtsCKgKWQc0gEYnvLkknS:ECtHycZEIvN3r/CtHycZEIvF
TLSH
T1F3A6BF12B7D08132E5B2123189759168AB76BC2487338E8F33947DADBFB25D05E79732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
23de5d49da36dc0d22de576aadfc84f04c103893ab9e1afa83252e90be412a78

File Explorer

23de5d49da36dc0d22de576aadfc84f04c103893ab9e1afa83252e90be412a78

.exe 9.6MB

23de5d49da36dc0d22de576aadfc84f04c103893ab9e1afa83252e90be412a78

IMPHASH 0f049ce24e217892c1b7f2d56270827d
SHA256 23de5d49da36dc0d22de576aadfc84f04c103893ab9e1afa83252e90be412a78
MD5 f420b85867e766a5faf076981632bec8
SHA1 a5500e0edab36e10875f695fd7b09b3c8c22093d
SHA512 ae2aec8741b1b382b222bfe477efafbc6d43a9d9707be6752dd716d6e49b88880d834df55c2169abbc3ab142824f95f15b5fe7670595e19a407aeb337179c61a
SSDEEP 196608:PU/jCtsCKgKWQc0gEYnvLkKC2C+CU/jCtsCKgKWQc0gEYnvLkknS:ECtHycZEIvN3r/CtHycZEIvF
TLSH
T1F3A6BF12B7D08132E5B2123189759168AB76BC2487338E8F33947DADBFB25D05E79732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9703

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GenerateConsoleCtrlEvent GetExitCodeProcess WaitForSingleObject CreateProcessA SetConsoleCtrlHandler GetModuleFileNameA EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep GetProcAddress ExitProcess GetCommandLineA SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind HeapReAlloc VirtualAlloc GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer HeapSize CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA ReadFile SetEndOfFile GetProcessHeap GetFileAttributesA

Sharing

General

Malware Config

Signatures

File Explorer

23de5d49da36dc0d22de576aadfc84f04c103893ab9e1afa83252e90be412a78

kernel32

generic