0a62a9ec4f5370ce0042f81508613b4d476534cffc12b757222c3c90cfef0ce3

General

Target
0a62a9ec4f5370ce0042f81508613b4d476534cffc12b757222c3c90cfef0ce3
Size 3.1MB
Sample260916-xdreasthpe
SHA256 0a62a9ec4f5370ce0042f81508613b4d476534cffc12b757222c3c90cfef0ce3
MD5 e83195ab3bb6c43eaa680b138d8adf55
SHA1 cf04a36ffff646dfb94bd2e9ce85449e11553417
SHA512 2952dcea1e2cdc0348482704a60e702c84f45436c266994501d555b72a3cf6dd3d9ab9a187da1fed1b9b7a621d30e5c1d976e952b075086783451ad3014ab2d0
SSDEEP 24576:/xjjjr9jjjrxjjjr9jjjrxjjjr9jjj1AHnh+eWsN3skA4RV1Hom2KXMmHahvtHW9:gh+ZkldoPK8YahFHRBnmnf4baczmcK
TLSH
T1F8E59E02A7A050BAEA668531CA12950DDB71BC46C7639F4F13901DEEBFF26905F2E731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a62a9ec4f5370ce0042f81508613b4d476534cffc12b757222c3c90cfef0ce3

File Explorer

0a62a9ec4f5370ce0042f81508613b4d476534cffc12b757222c3c90cfef0ce3

.exe 3.1MB

0a62a9ec4f5370ce0042f81508613b4d476534cffc12b757222c3c90cfef0ce3

IMPHASH ad2258898f0fbdcaaa6098836dd9129f
SHA256 0a62a9ec4f5370ce0042f81508613b4d476534cffc12b757222c3c90cfef0ce3
MD5 e83195ab3bb6c43eaa680b138d8adf55
SHA1 cf04a36ffff646dfb94bd2e9ce85449e11553417
SHA512 2952dcea1e2cdc0348482704a60e702c84f45436c266994501d555b72a3cf6dd3d9ab9a187da1fed1b9b7a621d30e5c1d976e952b075086783451ad3014ab2d0
SSDEEP 24576:/xjjjr9jjjrxjjjr9jjjrxjjjr9jjj1AHnh+eWsN3skA4RV1Hom2KXMmHahvtHW9:gh+ZkldoPK8YahFHRBnmnf4baczmcK
TLSH
T1F8E59E02A7A050BAEA668531CA12950DDB71BC46C7639F4F13901DEEBFF26905F2E731
MD5 SHA1 SHA512 SSDEEP TLSH

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

17932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\w64.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject FreeLibrary CreateProcessW SetHandleInformation WaitForSingleObjectEx AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar GetStartupInfoW GetTempPathW CreateJobObjectA GetStdHandle GetLastError GetProcAddress SetStdHandle LoadLibraryA GetFileType SetConsoleCtrlHandler SetCurrentDirectoryW CloseHandle GetProcessHeap SetEndOfFile SetEnvironmentVariableW CompareStringW FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc GetModuleHandleW DecodePointer HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EncodePointer TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount GetCommandLineA RtlUnwindEx DeleteCriticalSection LoadLibraryW FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc WriteFile HeapSetInformation GetVersion HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount Sleep LCMapStringW ReadFile SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CreateFileW HeapSize WriteConsoleW

user32

PostMessageW WaitForInputIdle PeekMessageW CreateWindowExW GetMessageW DestroyWindow

shlwapi

PathCombineW StrStrIW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

0a62a9ec4f5370ce0042f81508613b4d476534cffc12b757222c3c90cfef0ce3

kernel32

user32

shlwapi

generic