Static task
static1
Behavioral task
behavioral1
Sample
Payment Remittance Advice.exe
Resource
win7-20230220-en
General
-
Target
fde5052283982b31e8affce41a047ef3.bin
-
Size
509KB
-
MD5
4a55aa1ae1468c183f770b31be5d47c6
-
SHA1
437413a6b88fafc8f2839357ccdcf40d050edb38
-
SHA256
414c26d354b74910f3f9906d4ac77bad4ae3f723f2e841e1fbce1a9dbd224bf1
-
SHA512
12eef23c3c133b1ff84fcc12d3faf79a2d8e1b1460ee3f447082698359529a2eb797a2f2aea061c542fdcc4340d41069e41d33ba33267175e2352626b183529f
-
SSDEEP
12288:TTL/Z4tMDDBBAzw/Jem0poCAeiMngG0qLSWpomwO:T/Z4tIDXAJvpovMngJqLSWZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Payment Remittance Advice.exe
Files
-
fde5052283982b31e8affce41a047ef3.bin.zip
Password: infected
-
b2c8cd267b139c47bf4f07eb05e61cb39ec80db15de627adcce7051189665820.7z.7z
Password: infected
-
Payment Remittance Advice.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 566KB - Virtual size: 566KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ