Suspect
040b65e7b991e772aac124dd1664dcc1
AutoIt Compiled Script
MD5: 040b65e7b991e772aac124dd1664dcc1
Size: 5.68 MB
application/x-dosexec
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
File
Type
AutoIt Compiled Script
Size
5.68 MB · 5,681,664 B
Hashes
MD5
040b65e7b991e772aac124dd1664dcc1
Sha1
b7c2d058ae105e65cec9c0d90d0e8550b00ae26c
Sha256
e30cb7c91bfab4c261e8bb3f183a5df5b6957e5ebd22d754c2d13fffdb9d9eee
Sha384
4cb979b1dcf3b7c84910997c814cec7159f13f30b6a6589d9158271c1cd922399a0f05f4c04bec1426d5e6066afb16ae
Sha512
5b8bf9e1b80fcb75cd27b018f996c42c91a71eac739618657efcccb80ce20d63cfd21411f5f8b610bc9f5a6426526e6129f9f74d7bc2cacd8ff9b4af2aaf51d0
SSDeep
98304:S48axesGEKDlNgTlH7lHrwURUIQYtuwNK7fXZWp+6E9Zgghpmmsym:SO1GEKPgTNRHr4I5uwNK7xWr4WEpmm8
TLSH
2046336797910094E0321FBE6CEB18A14D737CD97B2D129F1580BB9B1DF37E226A071A
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)UPolyX 0.3 -> delikon
66 files
A3X040b65e7b991e772aac124dd1664dcc1
Structure
BINResources
BINAVI
BINID:0BB9
BINID:1033
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
IMGID:1033
IMGID:1033-preview.png
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINID:000D
BINID:1033
BINRT_DIALOG
BINID:07D1
BINID:1033
BINID:07D2
BINID:1033
BINID:07D3
BINID:1033
BINID:07D4
BINID:1033
BINID:07D5
BINID:1033
BINID:07D6
BINID:1033
BINRT_STRING
BINID:003F
BINID:1033
BINID:004C
BINID:1033
BINID:004D
BINID:1033
BINID:0050
BINID:1033
BINID:0053
BINID:1033
BINID:0055
BINID:1033
BINRT_RCDATA
BINID:0000
BINID:1033
A3XAutoIt3.exe
P7B[Authenticode]_b83b4241.p7b
BINRT_GROUP_CURSOR4
BINID:0BB8
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
A3XTonight.a3x
A3XAutoIt3.exe
Structure
P7B[Authenticode]_39db20af.p7b
BINResources
BINRT_ICON
BINID:0001
BINID:2057
BINID:0002
BINID:2057
BINID:0003
BINID:2057
BINID:0004
BINID:2057
BINID:0005
BINID:2057
BINID:0006
BINID:2057
BINID:0007
IMGID:2057
IMGID:2057-preview.png
BINID:0008
BINID:2057
BINID:0009
BINID:2057
BINID:000A
BINID:2057
BINID:000B
BINID:2057
BINID:000C
BINID:2057
BINID:000D
BINID:2057
BINRT_MENU
BINID:00A6
BINID:2057
BINRT_DIALOG
BINID:03E8
BINID:2057
BINRT_STRING
BINID:0007
BINID:2057
BINID:0008
BINID:2057
BINID:0009
BINID:2057
BINID:000A
BINID:2057
BINID:000B
BINID:2057
BINID:000C
BINID:2057
BINID:0139
BINID:2057
BINRT_GROUP_CURSOR4
BINID:0063
BINID:2057
BINID:00A2
BINID:2057
BINID:00A4
BINID:2057
BINID:00A9
BINID:2057
BINRT_VERSION
BINID:0001
BINID:2057
BINRT_MANIFEST
BINID:0001
BINID:1033
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 7
STICH kept: 1secondary ignored: 6
bin
4img
2Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:autoit
Shape
pe:exe>pe:autoit
2 nodes
| Name | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Info | PDB Path: wextract.pdb |
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
66 files
A3X040b65e7b991e772aac124dd1664dcc1
Structure
BINResources
A3XTonight.a3x
A3XAutoIt3.exe
No malware configuration was found at this point.
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
040b65e7b991e772aac124dd1664dcc1 › Resources › RT_RCDATA › ID:0000 › ID:1033 › AutoIt3.exe
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.