General
-
Target
PDF-Wedding ring.rar
-
Size
40.9MB
-
MD5
c3674f0f78b12d8a950cab5d982c393d
-
SHA1
4ade61f6503bac63b9cfa2ce09c06dbc3f70a7b9
-
SHA256
84eadeff7f9e2fb58f0b8b6e7a9649a80aa4ee7ce69c138c717e819b8bcc724b
-
SHA512
3a3ac7161c5045f680d301095e126ef74bfc456410f7abdfae69eef09347dee7831b5c3180d16cc984a727ff80e924f518fa5caca6085d9b6c48891c58817923
-
SSDEEP
786432:vSW2MTU1bhzNqDKdiI2jgt/Z5ydjhv6DIxP4S1hBjUgdC/oTLK5T:gym2jgt/Z5I2UxjUSC6LK5T
Malware Config
Signatures
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PDF-Wedding ring.exe
Files
-
PDF-Wedding ring.rar.rar
Password: 6666
-
PDF-Wedding ring.exe.exe windows x86
Password: 6666
61994d1801eaf0210dd7d28ddb3a12a9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFullPathNameW
GetTempPathW
GetLastError
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCurrentProcess
IsWow64Process
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetEnvironmentVariableW
OutputDebugStringW
GetCurrentProcessId
Sleep
RemoveDirectoryW
LeaveCriticalSection
CreateDirectoryW
RtlUnwind
RaiseException
InitializeSListHead
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
InitializeCriticalSectionAndSpinCount
SetLastError
DecodePointer
EncodePointer
GetStringTypeW
advapi32
RegisterEventSourceW
DeregisterEventSource
RegGetValueW
RegOpenKeyExW
RegCloseKey
ReportEventW
api-ms-win-crt-runtime-l1-1-0
_errno
terminate
__p___wargv
_c_exit
_exit
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_register_onexit_function
_initterm_e
_register_thread_local_exe_atexit_callback
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_configure_wide_argv
_controlfp_s
abort
_initialize_wide_environment
_get_initial_wide_environment
__p___argc
_initterm
exit
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
_set_new_mode
free
malloc
api-ms-win-crt-math-l1-1-0
frexp
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
fflush
__stdio_common_vfwprintf
fputws
__stdio_common_vsprintf_s
fputwc
__acrt_iob_func
_set_fmode
_wfopen
fwrite
fseek
__stdio_common_vswprintf
fclose
fread
api-ms-win-crt-string-l1-1-0
memset
strcspn
_wcsdup
wcsncmp
_wcsicmp
strcpy_s
wcsnlen
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_unlock_locales
_lock_locales
setlocale
___mb_cur_max_func
_configthreadlocale
localeconv
api-ms-win-crt-filesystem-l1-1-0
_wrename
_wremove
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64
_time64
Sections
.text Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ