0a46f848c46b91293f0657bb4cae4f47444606671d3b55c22f4bb94343b7a71e

General

Target
0a46f848c46b91293f0657bb4cae4f47444606671d3b55c22f4bb94343b7a71e
Size 9.1MB
Sample260916-xc8xysce95
SHA256 0a46f848c46b91293f0657bb4cae4f47444606671d3b55c22f4bb94343b7a71e
MD5 4ff593ed127c617a07bd31c0152e4570
SHA1 32d34ad05d592ad7929cebc1f6536ac805c92253
SHA512 32385598c848885594794cf0c6c893ee9b52d3ca89fc91c85144725764c9ccb95cb88a32dd2f1d0c2c313d3a4aec4d70d3b54347a68ba898fbeff1fe61eda5d4
SSDEEP 98304:wOU/jIEeQfoR/IuOFVjUu55K2cPK8x1OU/jIEeQfoR/IuOFVjUu55K2cPK8xT7p:wFIF0wuPlCKqFIF0wuPlCK
TLSH
T1BEA68C1277D48072F5B31231897592199675B86587338EDF338C1A9EAFB16D08E3AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a46f848c46b91293f0657bb4cae4f47444606671d3b55c22f4bb94343b7a71e

File Explorer

0a46f848c46b91293f0657bb4cae4f47444606671d3b55c22f4bb94343b7a71e

.exe 9.1MB

0a46f848c46b91293f0657bb4cae4f47444606671d3b55c22f4bb94343b7a71e

IMPHASH ad2258898f0fbdcaaa6098836dd9129f
SHA256 0a46f848c46b91293f0657bb4cae4f47444606671d3b55c22f4bb94343b7a71e
MD5 4ff593ed127c617a07bd31c0152e4570
SHA1 32d34ad05d592ad7929cebc1f6536ac805c92253
SHA512 32385598c848885594794cf0c6c893ee9b52d3ca89fc91c85144725764c9ccb95cb88a32dd2f1d0c2c313d3a4aec4d70d3b54347a68ba898fbeff1fe61eda5d4
SSDEEP 98304:wOU/jIEeQfoR/IuOFVjUu55K2cPK8x1OU/jIEeQfoR/IuOFVjUu55K2cPK8xT7p:wFIF0wuPlCKqFIF0wuPlCK
TLSH
T1BEA68C1277D48072F5B31231897592199675B86587338EDF338C1A9EAFB16D08E3AB33
MD5 SHA1 SHA512 SSDEEP TLSH

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

17932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\w64.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject FreeLibrary CreateProcessW SetHandleInformation WaitForSingleObjectEx AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar GetStartupInfoW GetTempPathW CreateJobObjectA GetStdHandle GetLastError GetProcAddress SetStdHandle LoadLibraryA GetFileType SetConsoleCtrlHandler SetCurrentDirectoryW CloseHandle GetProcessHeap SetEndOfFile SetEnvironmentVariableW CompareStringW FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc GetModuleHandleW DecodePointer HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EncodePointer TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount GetCommandLineA RtlUnwindEx DeleteCriticalSection LoadLibraryW FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc WriteFile HeapSetInformation GetVersion HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount Sleep LCMapStringW ReadFile SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CreateFileW HeapSize WriteConsoleW

user32

PostMessageW WaitForInputIdle PeekMessageW CreateWindowExW GetMessageW DestroyWindow

shlwapi

PathCombineW StrStrIW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

0a46f848c46b91293f0657bb4cae4f47444606671d3b55c22f4bb94343b7a71e

kernel32

user32

shlwapi

generic