roforma Invoice[.]pdf[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
roforma Invoice.pdf.exe
Size 470KB
Sample201109-atagbzsabe
SHA256 1122cb2dfa13da1338dcb354406c8cacdb6362705486987af89f63e814afca7a
MD5 dcd12645f75343a3275cf6a219fb92da
SHA1 abdec8bf4fc0e9dc3a985b9485b8e4e760e5d564
SHA512 63239ab7f478f0175640bc3d942065a816c3dcad84f1fe72aa99bcc1b59ebcb3a0dffd79969618eac9742409d97ba43dd51b13f2f35e3e34b1c2e883741385af
MD5 SHA1 SHA512

Score

9^/10

Malware Config

Signatures

ServiceHost packer 1 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
sample	servicehost

File Explorer

roforma Invoice.pdf.exe

.exe 470KB

roforma Invoice.pdf.exe

SHA256 1122cb2dfa13da1338dcb354406c8cacdb6362705486987af89f63e814afca7a
MD5 dcd12645f75343a3275cf6a219fb92da
SHA1 abdec8bf4fc0e9dc3a985b9485b8e4e760e5d564
SHA512 63239ab7f478f0175640bc3d942065a816c3dcad84f1fe72aa99bcc1b59ebcb3a0dffd79969618eac9742409d97ba43dd51b13f2f35e3e34b1c2e883741385af
MD5 SHA1 SHA512

windows x86

ServiceHost packer

Detects ServiceHost packer used for .NET malware