Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.pdf.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Purchase Order.pdf.exe
Resource
win10v2004-20230220-en
General
-
Target
Purchase Order.pdf.exe
-
Size
851KB
-
MD5
cb1a89175fef9adcf11ee2065e66d656
-
SHA1
05302a241bb8c8594adfce417f0a8116ed00dbfd
-
SHA256
4634594a43ca9d6f4630aecf8a17a04a1b2e942cafa3080a4064e2ec7741bd5f
-
SHA512
b444499b4314c551012ca6c9109e7d3a9c200cd808799661959376cf94b09ba8b11b3f4cc15250ef744720d86357db6de58b51cd4c1aa0f41e0d535b8f83e0df
-
SSDEEP
12288:fFP1U2IDZfOtXyacaHJTxh+i3SkfU9+tfElOfw3ley5qtAs/K8c:fZ1U2I1qXdxhPi3dOqley5qtBy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Purchase Order.pdf.exe
Files
-
Purchase Order.pdf.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 818KB - Virtual size: 817KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ