Static task
static1
Behavioral task
behavioral1
Sample
Payment confirmation HA-9VVNL7.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Payment confirmation HA-9VVNL7.exe
Resource
win10v2004-20230220-en
General
-
Target
2e33427db3e3f85a33a157401d2f7a5a.bin
-
Size
613KB
-
MD5
f6b0f8bee53ff055b9d947d8c7562a00
-
SHA1
664a87bf6c89313d5eef99ff8f5ddf0bf14b8e91
-
SHA256
0b4b0facf653d1b26fa05160470fdeac49314bfdd84d4d3d37f080b5cb451950
-
SHA512
c3033b7ba020debad90ccac096a3b5d6cdedbda076a6fdd718faef93a6f74edb60475ec55c00855332064aadb78633b1700dcb47112aaa9ebd34a43ac2ba00a8
-
SSDEEP
12288:RL+4/W8G8nYwSOIsPiiei3/1dO3vSfAKYOwwh63s6+VfsppZVlYosFQLu:dLWt8YDsPiaa3IAKrwZHVlYosWLu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Payment confirmation HA-9VVNL7.exe
Files
-
2e33427db3e3f85a33a157401d2f7a5a.bin.zip
Password: infected
-
dffe351852b4d59a792f31ab4369c339f7ba61936453b6f9b9724adf5f4a42ce.rar.rar
Password: infected
-
Payment confirmation HA-9VVNL7.exe.exe windows x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 561KB - Virtual size: 561KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 254KB - Virtual size: 253KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 64B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ