IncomeTax_Challan_Copy[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

IncomeTax_Challan_Copy.exe
Size

769KB
MD5

2d99cf2f45d55469da1cc7bd2079f1c7
SHA1

1182a5dde2f036f746bd781567c488bd3e69b789
SHA256

24c80d34a34d1fc2004bb9ebf537e6e0cdfd339b86b7418e8e95c7ad19ea2ccc
SHA512

dd2f88e9c88b597d235627bb594a1bf55e05009d64333bb0351becf9110ce81fd7325a4f382ebf08678fd1d9e3a8894d9984976941dec96334c6ed27b908886d
SSDEEP

12288:3uPn2ytSIpGDnmBAjzcJFEmVMp46A9jmP/uhu/yMS08CkntxYRZL:UnPabmBKCZfmP/UDMS08Ckn3w

Score

1^/10

Malware Config

Signatures

Files

IncomeTax_Challan_Copy.exe
.exe windows x86

3203ac73c4535d979af200fc5e459e21

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord582
ord690
ord583
ord696
ord698
MethCallEngine
ord516
ord518
ord626
ord519
ord666
ord667
ord591
ord593
ord594
ord595
ord596
ord303
ord598
ord520
ord309
ord631
ord525
ord632
ord526
EVENT_SINK_AddRef
ord528
ord529
DllFunctionCall
ord563
ord670
ord564
EVENT_SINK_Release
ord600
ord601
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
ord713
ord714
ord607
ord608
ord716
ord717
ProcCallEngine
ord644
ord537
ord645
ord570
ord648
ord573
ord681
ord576
ord685
ord100
ord689
ord616
ord617
ord618
ord619
ord581

Sections

.text
Size: 500KB - Virtual size: 496KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ