shipment airway bill_pdf[.]gz

Sharing

Copy URL Twitter E-mail

General

Target
shipment airway bill_pdf.gz
Size 209KB
Sample221114-mr866agg73
SHA256 cbbdd11f3c10442270e55644139bb1b4a7917393b2b7084df6057151470e2bbc
MD5 c9213e536d6f36843c625f15ebf98609
SHA1 6331cc3a13f80144e0e8be2972f88d157b5787bc
SHA512 adaf69c9ee5156b3aa1a482dff9df92d3b4504bf69c0f19a24d3ee8c9a315c38d0214a0338cc644e1c576705711e969225152ff467e6fc9f16eeb99cc9aefc1f
SSDEEP 6144:Yts2T7DPxZQGQfdJKKRBLJuFw4fj38KssoQ7:t2T7DPAGQVpLR4Lya
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

NSIS installer 2 IoCs

installer

resource	yara_rule
static1/unpack001/shipment airway bill_pdf.exe	nsis_installer_1
static1/unpack001/shipment airway bill_pdf.exe	nsis_installer_2

File Explorer

shipment airway bill_pdf.gz

.gz 209KB
shipment airway bill_pdf.exe

.exe 222KB

shipment airway bill_pdf.gz

SHA256 cbbdd11f3c10442270e55644139bb1b4a7917393b2b7084df6057151470e2bbc
MD5 c9213e536d6f36843c625f15ebf98609
SHA1 6331cc3a13f80144e0e8be2972f88d157b5787bc
SHA512 adaf69c9ee5156b3aa1a482dff9df92d3b4504bf69c0f19a24d3ee8c9a315c38d0214a0338cc644e1c576705711e969225152ff467e6fc9f16eeb99cc9aefc1f
SSDEEP 6144:Yts2T7DPxZQGQfdJKKRBLJuFw4fj38KssoQ7:t2T7DPAGQVpLR4Lya
MD5 SHA1 SHA512 SSDEEP

shipment airway bill_pdf.exe

IMPHASH 29b61e5a552b3a9bc00953de1c93be41
SHA256 071b55748a4bf8024c8db0de1a1e0201eb18bac7def0ceb902f0ff18039dfb2e
MD5 cb8241dbfc0c15ca8618989f04b55bed
SHA1 bc23abe2afe3d59c58ef90fdf93037d1187aade2
SHA512 6bc9e10cf69234a8d03013574a0ca5157b9254039adb9af2df1ef0f090a733ac7f31c53cccc95227822f8bd02087958da18f0a88c9211903f0c1ef7d94dcf9c7
SSDEEP 6144:MEa0Nq+TfDPxVQGQfdJKeRVLJuBMCfjXMKs4oi:Xq+TfDPYGQVfLJCL0i
MD5 SHA1 SHA512 SSDEEP

windows x86

NSIS installer

installer

Minor OS version

Major OS version

Entry point

12529

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileAttributesA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CompareFileTime SearchPathA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess CreateDirectoryA lstrcmpiA GetCommandLineA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA LoadLibraryA SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc WaitForSingleObject GetWindowsDirectoryA GetTempPathA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv LoadLibraryExA GetModuleHandleA MultiByteToWideChar FreeLibrary

user32

GetWindowRect EnableMenuItem GetSystemMenu ScreenToClient SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow PostQuitMessage RegisterClassA EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow OpenClipboard TrackPopupMenu SendMessageTimeoutA GetDC LoadImageA GetDlgItem FindWindowExA IsWindow SetClipboardData SetWindowLongA EmptyClipboard SetTimer CreateDialogParamA wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_Destroy ord17 ImageList_AddMasked

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance