Static task
static1
Behavioral task
behavioral1
Sample
HSBC Payment Advice _pdf.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
HSBC Payment Advice _pdf.exe
Resource
win10v2004-20230220-en
General
-
Target
6ee8c7de4d12daaa9a1143ec55e6e531.bin
-
Size
725KB
-
MD5
0fab51296c6ccf2a9e819dd5a9cf3277
-
SHA1
db6e9e854ace674940ebc5b6cb3033fc4a0839ef
-
SHA256
1d341baa547b1cdcbb074e27b249b9bdccb5300da3ab5b7f279cc1ac967878f4
-
SHA512
e79576479101c29b316c84c2ef47bc3d293fed747cc7ce51e70974bf3bebb95580c9c26455a7083aec4730f97d5c29d710604424378c5e9d2a19568909f851e1
-
SSDEEP
12288:I56gPWsgbiokhrgSxa3j0w8iQwP/gmwyf859xpRX/ETUgLAXi7JFdIttoisvR3Ui:I5TPWmxhAL8iQ+4mvf8blXSUgXqQDvl/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/HSBC Payment Advice _pdf.exe
Files
-
6ee8c7de4d12daaa9a1143ec55e6e531.bin.zip
Password: infected
-
405663c97f0b9920937968fbea651b5bd4c6e58c4823537f8ff3acd5000a3d1a.gz.rar
Password: infected
-
HSBC Payment Advice _pdf.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 776KB - Virtual size: 776KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 134KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ