Static task
static1
Behavioral task
behavioral1
Sample
2023年4月工资绩效异常反馈表(2023年5月24日前反馈).pdf.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023年4月工资绩效异常反馈表(2023年5月24日前反馈).pdf.exe
Resource
win10v2004-20230220-en
General
-
Target
2023Äê4Ô¹¤×ʼ¨Ð§Òì³£·´À¡±í(2023Äê5ÔÂ24ÈÕǰ·´À¡).pdf.7z
-
Size
326KB
-
MD5
452035280a962d9d73d331ba92aa5466
-
SHA1
e362c4b54b3be0197aceaae3e3736062787fe9d6
-
SHA256
452c75ab84f6944c27e649f5204912c76ec1d62340bc791793b753550b209200
-
SHA512
5c2181213b94c7bdcdcd882cc81960c09961e6483485dedd76df300551540f2d1db0e028f0599fa71c75c317bc3c263c9833eb6593b90fe76a6fd14b8d6eb12f
-
SSDEEP
6144:C6XEu8z1pys4zywKiiI6FLfkQzc8Mt4UmxzLdac3gse2eYb3oq8:LV8J7kywKkAc8MGjacJ9nX8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/2023年4月工资绩效异常反馈表(2023年5月24日前反馈).pdf.com
Files
-
2023Äê4Ô¹¤×ʼ¨Ð§Òì³£·´À¡±í(2023Äê5ÔÂ24ÈÕǰ·´À¡).pdf.7z.7z
Password: infected
-
2023年4月工资绩效异常反馈表(2023年5月24日前反馈).pdf.com.exe windows x64
8684c8a524672e3e300a55a00a318302
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleFileNameW
WideCharToMultiByte
CreateProcessA
GetLastError
ReadFile
WriteFile
CreateFileW
MultiByteToWideChar
CloseHandle
WriteConsoleW
HeapSize
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
GetStdHandle
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
HeapAlloc
HeapFree
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
FlsAlloc
FlsGetValue
SetEndOfFile
shell32
ShellExecuteA
Sections
.text Size: 202KB - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 570KB - Virtual size: 570KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ