Static task
static1
Behavioral task
behavioral1
Sample
Payment (2).exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Payment (2).exe
Resource
win10v2004-20230220-en
General
-
Target
d90dc4011ae0968a98859f42a06277d4.bin
-
Size
423KB
-
MD5
399ab88aaf06c9d2342c018b68223006
-
SHA1
71386d6abddf5bd8f4ac958a1cc728dd438daa3b
-
SHA256
24b32fae45de625284629159956494fd1b33ca4a1210991c32ec9d176e3ac137
-
SHA512
dce33571580ca2abef3130d2a0edb07dc85558d98271192ed30284101e57490f057d1e51ea925ff5755c049237a40467d7bec839c5e7f34f6e41d020c8a12af0
-
SSDEEP
6144:QruEZ2iaF7niwmVCgjZo4R4JKGdffte8iuU55Lcl3BLjF+JWcGqSpz3snLKUQiUG:QhZ2iOiwsrjX43dX066IccNiUJGS2mLc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack002/Payment (2).exe
Files
-
d90dc4011ae0968a98859f42a06277d4.bin.zip
Password: infected
-
c5ef403f6eb24be53ab7293ad56c54f6853df005b6b9d34c48f0132d794a32d9.rar.rar
Password: infected
-
Payment (2).exe.exe windows x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 522KB - Virtual size: 522KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 378KB - Virtual size: 378KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ