Malicious
Malicious

SANDY.exe

Share on LinkedIn
Print
AutoIt Compiled Script
MD5: 5815909bb48b01c75bf69885c5b6a040
Size: 567.87 KB
application/x-dosexec
Summary by MalvaGPT
Characteristics
Hash
 Hash Value
MD5
5815909bb48b01c75bf69885c5b6a040
Sha1
1fb9d9c3074dc78a7aa0dac53f5b36b08cea26e8
Sha256
d8b950b1953736d0ec36042bf1a06deac2fe425b1ccc14663c3e2b2d03f26885
Sha384
ca91d7314e4cb86749628ca3a26336424bb773fd6ccefe6dbd063a36a557bd2a4f93be7489245bf46a78b81f9a99a2fe
Sha512
bad7199a5101ee6810be5b3e92797173cf93e05b1aacea25387296aa810149e22dd75b22ee75643ea93ac7591564471a78e80227f6e021a10793a4383a722749
SSDeep
12288:KABhABEXotkI0A8AyzKOcv3omlHD77sCDGw:DBqBEqfRXyRu3o2j77skGw
TLSH
30C4AE277DE190B6D6B236B47F66D329637AFD300631A50B67D00CCA7763980AA35723

PeID

ASProtect v1.32
Armadillo v2.xx (CopyMem II)
Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++ 6.0 DLL (Debug)
Microsoft Visual C++ 7.0
Microsoft Visual C++ 7.0 - 8.0
Microsoft Visual C++ 7.1
Microsoft Visual C++ v6.0 DLL
Microsoft Visual C++ v7.0
File Structure
SANDY.exe
Malicious
Overlay_6b537d3b.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
Resources
RT_ICON
ID:0001
ID:2057
ID:0002
ID:2057
ID:0003
ID:2057
ID:0004
ID:2057
ID:0005
ID:2057
RT_MENU
ID:00A6
ID:2057
RT_DIALOG
ID:03E8
ID:2057
RT_STRING
ID:0007
ID:2057
ID:0008
ID:2057
ID:0009
ID:2057
ID:000A
ID:2057
ID:000B
ID:2057
ID:000C
ID:2057
RT_GROUP_CURSOR4
ID:00A1
ID:2057
ID:00A4
ID:2057
ID:00A9
ID:2057
RT_VERSION
ID:0001
ID:2057
RT_MANIFEST
ID:0001
ID:2057
aut4D28.tmp
Malicious
[Cleaned].au3
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Overlay extracted: Overlay_6b537d3b.bin (135744 bytes)
SANDY.exe (567.87 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙