Malicious
d0d0ca6db869e42b291ded68617273bc
AutoIt Compiled Script
MD5: d0d0ca6db869e42b291ded68617273bc
Size: 1.19 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
This sample is a 1.1 MB AutoIt Compiled Script classified as malicious by Malva.RE. Static analysis extracted 28 embedded or derived files. It matches 8 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- dd56ed5cf4a23ae82f28423890e13b64e12b130088fe4fb1e71ecf491cfacf4f
- MD5
- d0d0ca6db869e42b291ded68617273bc
- Verdict
- Malicious
- File type
- AutoIt Compiled Script · 1.1 MB
Cite this report: https://app.malva.re/sha256/dd56ed5cf4a23ae82f28423890e13b64e12b130088fe4fb1e71ecf491cfacf4f
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
AutoIt Compiled Script
Size
1.19 MB · 1,190,400 B
First seen
2025-07-14 07:47 · one year ago
Last seen
2025-07-14 07:47 · one year ago
Last analysis
2025-07-14 07:54 · one year ago
Hashes
MD5
d0d0ca6db869e42b291ded68617273bc
Sha1
7cb72c0c96cfa99a2fa4d9542f3c4dc55e018a20
Sha256
dd56ed5cf4a23ae82f28423890e13b64e12b130088fe4fb1e71ecf491cfacf4f
Sha384
1e6f2d91b53ee19c904bfe71e5a95a20a6305d57c36b182b593cbaae3eb9cc88af61bdd215c65c9d5a92cd14b384d228
Sha512
637f2b33971d07230b7fdb4b57a814d699327763a7dc0eef314e26a495f405b6ebb51190438d3c973b5071e380ba7566c68f3eb33fb29ae95c358a6dfc0f2a14
SSDeep
24576:ctb20pkaCqT5TBWgNQ7adraSEqhb07ecY4KBnwJ3k16A:FVg5tQ7admkcY9JwJ3s5
TLSH
9845CF1373DD8361C7B25273BA26B701AE7F782506A5F96B2FD40D3DB820122525EA73
Detection
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
3 malicious · 29 files
A3Xd0d0ca6db869e42b291ded68617273bc
Structure
A3Xaut89BB.tmp.tok
A3X[Cleaned].au3
BINResources
BINRT_ICON
BINID:0001
BINID:2057
BINID:0002
BINID:2057
BINID:0003
BINID:2057
BINID:0004
BINID:2057
BINID:0005
BINID:2057
BINID:0006
BINID:2057
BINID:0007
BINID:2057
BINID:0008
BINID:2057
BINID:0009
BINID:2057
BINID:000A
BINID:2057
BINID:000B
BINID:2057
BINRT_MENU
BINID:00A6
BINID:2057
BINRT_STRING
BINID:0007
BINID:2057
BINID:0008
BINID:2057
BINID:0009
BINID:2057
BINID:000A
BINID:2057
BINID:000B
BINID:2057
BINID:000C
BINID:2057
BINID:0139
BINID:2057
BINRT_RCDATA
BINID:0000
A3XID:0
BINRT_GROUP_CURSOR4
BINID:0063
BINID:2057
BINID:00A2
BINID:2057
BINID:00A4
BINID:2057
BINID:00A9
BINID:2057
BINRT_VERSION
BINID:0001
BINID:2057
BINRT_MANIFEST
BINID:0001
BINID:2057
PDB Path
PATH
?huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential3 malicious · 29 files
A3Xd0d0ca6db869e42b291ded68617273bc
Structure
A3Xaut89BB.tmp.tok
A3X[Cleaned].au3
BINResources
No malware configuration was found at this point.
PDB Path
PATH
?huhuhuhu
d0d0ca6db869e42b291ded68617273bc
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account