Suspicious
Suspect

AutoIt Compiled Script
MD5: 4f7429c7135e65cc0650b1334486a580
Size: 1.21 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 4f7429c7135e65cc0650b1334486a580
Sha1 7927489235730c977894f20d41b0f107ed6a5286
Sha256 4d69e1c88a9ca803fd7f02395dc2f3a737c32a13fe6ee801cb908fb075cd0e86
Sha384 178e36ef6bb8032ffe851fe45ade39f5faa276766d6cc58889a5bf87a32a5087e9911486c38ac7174363c406f07f6782
Sha512 8b48148a7f6147f7b7e6e4da853e752d56dd6745702c6088858e38f23c86bd384f05f1da0d7cb15b9d2095fcd49d2bac878d11f1dfb80f7b6a69b3270c233264
SSDeep 24576:ajIOHvCjQkPFxu+o31qBPs76ItlU1AyVVOcXLCR6B/oTRV:ajIekPT7BMlU1AA7Xu0
TLSH F745231E17E43597E83AA37996F50697AB337AE22B3906FF51E494B40E131D8263070F
PeID
Microsoft Visual C++ 8.0 (DLL)
[Authenticode]_e62f832e.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
AVI
ID:0BB9
ID:1033
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
RT_DIALOG
ID:07D1
ID:1033
ID:07D2
ID:1033
ID:07D3
ID:1033
ID:07D4
ID:1033
ID:07D5
ID:1033
ID:07D6
ID:1033
RT_STRING
ID:0050
ID:1033
ID:0053
ID:1033
ID:0055
ID:1033
RT_RCDATA
ID:0000
ID:1033
RT_GROUP_CURSOR4
ID:0BB8
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Muscles.ppam
Person.ppam
Imports.ppam
Conventions
Camcorder
Orchestra
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x125000 size 11920 bytes
Info
PDB Path: wextract.pdb
[Authenticode]_e62f832e.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
AVI
ID:0BB9
ID:1033
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
RT_DIALOG
ID:07D1
ID:1033
ID:07D2
ID:1033
ID:07D3
ID:1033
ID:07D4
ID:1033
ID:07D5
ID:1033
ID:07D6
ID:1033
RT_STRING
ID:0050
ID:1033
ID:0053
ID:1033
ID:0055
ID:1033
RT_RCDATA
ID:0000
ID:1033
RT_GROUP_CURSOR4
ID:0BB8
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Muscles.ppam
Person.ppam
Imports.ppam
Conventions
Camcorder
Orchestra
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙