Static task
static1
Behavioral task
behavioral1
Sample
EWB Wire Transfer FORM_pdf.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
EWB Wire Transfer FORM_pdf.exe
Resource
win10v2004-20230220-en
General
-
Target
EWB Wire Transfer FORM_pdf.exe
-
Size
995KB
-
MD5
23c00b988501419966eb99c5bad5e7f2
-
SHA1
5a75c9e01a173849329a853c29296ed9b11a607b
-
SHA256
4715a9aac1b5c29bbff09d78bba246d126fc72663241e4293b1273bb1f46535b
-
SHA512
026f04a19cbdfe5c7d44e2a32c3c7ec568a559f76977254316f44bd1e0b4aeb4ac01bd3ff64053e2c9cb7fc760db98b9907544af99b17584edc4f40dd77e77ef
-
SSDEEP
24576:uBdnON4ySIto3zLiYeeCcX5G0ZxxBvAZ5Jdy5tFjuxISXj:+6mbJ1soy/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource EWB Wire Transfer FORM_pdf.exe
Files
-
EWB Wire Transfer FORM_pdf.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 993KB - Virtual size: 993KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ