Overview

overview

10

Static

static

9

PO_Invoices_pdf.exe

windows7_x64

9

PO_Invoices_pdf.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    135s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    08-02-2022 03:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PO_Invoices_pdf.exe

  • Size

    1.6MB

  • MD5

    59d7d8d5dd3e0055e7c0dcc75897f569

  • SHA1

    b249b28d088d54e971e2d9d8b2688440f8e6d513

  • SHA256

    ef715cd322f0a805a68840b215c062f2e254977170a11c6800d836eac781fabb

  • SHA512

    79ebc2a128d018eb7e71b254fdd2fa72deae18081f1732619046e1db9d1aee92f7529521c005a5f861275afcbda3a39fd304cd5e1a49df848675460c5cf8f30d

Score
9/10

Malware Config

Signatures

  • Beds Protector Packer 2 IoCs

    Detects Beds Protector packer used to load .NET malware.

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO_Invoices_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\PO_Invoices_pdf.exe"
    1⤵
      PID:1116

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1116-55-0x0000000074B40000-0x000000007522E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/1116-56-0x0000000000C40000-0x0000000000DDA000-memory.dmp
      Filesize

      1.6MB

      Download
    • memory/1116-57-0x0000000004C50000-0x0000000004DE2000-memory.dmp
      Filesize

      1.6MB

      Download
    • memory/1116-58-0x0000000076511000-0x0000000076513000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1116-59-0x00000000005F0000-0x00000000006D0000-memory.dmp
      Filesize

      896KB

      Download