22a5321fd34ba4500308ab27b2017687c9183c1cb1d12a60884e423170c4cfd0

General

Target
22a5321fd34ba4500308ab27b2017687c9183c1cb1d12a60884e423170c4cfd0
Size 3.4MB
Sample260916-1zmvsagj21
SHA256 22a5321fd34ba4500308ab27b2017687c9183c1cb1d12a60884e423170c4cfd0
MD5 ad449f94a382b34b01e1748bdd3bae6a
SHA1 2060e5b8f3e2c99e8e15f26c211aa6fea87a5fcb
SHA512 4a6ba8c5132b708777d41030ca3f06154e1d3d3ad3f6b006687040e3c331296cc7e6df2808787b1512167fa47325b07a1287d30cb2a446aef3688f5b57ae7fc4
SSDEEP 49152:Kh+ZkldoPK8YahFHRBzlh+ZkldoPK8YahFHRBzoAojT:D2cPK8xfi2cPK8xfST
TLSH
T1A9F59E0277A080B6FEA685328A16A50DD7757C5586238E4F13941DEEBFF26A05F3D332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
22a5321fd34ba4500308ab27b2017687c9183c1cb1d12a60884e423170c4cfd0

File Explorer

22a5321fd34ba4500308ab27b2017687c9183c1cb1d12a60884e423170c4cfd0

.exe 3.4MB

22a5321fd34ba4500308ab27b2017687c9183c1cb1d12a60884e423170c4cfd0

IMPHASH ad2258898f0fbdcaaa6098836dd9129f
SHA256 22a5321fd34ba4500308ab27b2017687c9183c1cb1d12a60884e423170c4cfd0
MD5 ad449f94a382b34b01e1748bdd3bae6a
SHA1 2060e5b8f3e2c99e8e15f26c211aa6fea87a5fcb
SHA512 4a6ba8c5132b708777d41030ca3f06154e1d3d3ad3f6b006687040e3c331296cc7e6df2808787b1512167fa47325b07a1287d30cb2a446aef3688f5b57ae7fc4
SSDEEP 49152:Kh+ZkldoPK8YahFHRBzlh+ZkldoPK8YahFHRBzoAojT:D2cPK8xfi2cPK8xfST
TLSH
T1A9F59E0277A080B6FEA685328A16A50DD7757C5586238E4F13941DEEBFF26A05F3D332
MD5 SHA1 SHA512 SSDEEP TLSH

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

17932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\w64.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject FreeLibrary CreateProcessW SetHandleInformation WaitForSingleObjectEx AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar GetStartupInfoW GetTempPathW CreateJobObjectA GetStdHandle GetLastError GetProcAddress SetStdHandle LoadLibraryA GetFileType SetConsoleCtrlHandler SetCurrentDirectoryW CloseHandle GetProcessHeap SetEndOfFile SetEnvironmentVariableW CompareStringW FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc GetModuleHandleW DecodePointer HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EncodePointer TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount GetCommandLineA RtlUnwindEx DeleteCriticalSection LoadLibraryW FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc WriteFile HeapSetInformation GetVersion HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount Sleep LCMapStringW ReadFile SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CreateFileW HeapSize WriteConsoleW

user32

PostMessageW WaitForInputIdle PeekMessageW CreateWindowExW GetMessageW DestroyWindow

shlwapi

PathCombineW StrStrIW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

22a5321fd34ba4500308ab27b2017687c9183c1cb1d12a60884e423170c4cfd0

kernel32

user32

shlwapi

generic