Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Purchase Order.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
Purchase Order.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Purchase Order.exe
Resource
win10v2004-20230220-en
General
-
Target
c2ff9f433b86048529020cb22f7bea9e.bin
-
Size
1004KB
-
MD5
b8a4eb390178430520d20f95fab8bf81
-
SHA1
d2eeef5f6604d145086c681e32dc5efa098d45f4
-
SHA256
59252b6a903a3601674663f41a8826b612d7bd6812c93151e7c1149e7232d046
-
SHA512
76e07ffa0ebc429d78f1537b685ceffd024d09db2b7beb47e173756ec67abccf8eaa685647af37dc4ae379369ab214059daef4f86a588fe004a9f37f1c7a08ea
-
SSDEEP
24576:g7Svl5jJE06/NMp+2iGshZu0gRdy5PFdB/ckai9YfIqV+x10XiRK3d:g78l5VSFMWGs7u0gwHowwiRu
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/Purchase Order.exe unpack001/Purchase Order.exe
Files
-
c2ff9f433b86048529020cb22f7bea9e.bin.zip
Password: infected
-
68332659490e748cae603f66d2011e055efb985711b8f99f44d1262b49030c97.zip.zip
Password: infected
-
Purchase Order.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 577KB - Virtual size: 577KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Purchase Order.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 577KB - Virtual size: 577KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ