Static task
static1
Behavioral task
behavioral1
Sample
Purchase Inquiry.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Purchase Inquiry.exe
Resource
win10v2004-20230621-en
General
-
Target
32a20b4fbe74d2e53b5e0ae9ffabeb00.bin
-
Size
979KB
-
MD5
0c41207f9b8745ee8c0d18ee4db1ac1b
-
SHA1
9075cc72985e2d4d0e9cf3e12efd381edc726848
-
SHA256
c5c13d84baf9647a9defea4fcc81009508cc3d940fdc9e9ca6421c41c0348c5d
-
SHA512
aefc771a324d086463491c6c7538119a30630ee8ca4aa347acbc27b8c8d9b36272ed344ca425942b8a9b1eef95e9a3655241140f6d2c34094247b7b199a0cf90
-
SSDEEP
24576:wbnPgFCksYKDQ7qRRWl7zB4qDFKhdk+YpEZzY/9FO:wbYQYKsVlnxFKhdk+9Y9FO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Purchase Inquiry.exe
Files
-
32a20b4fbe74d2e53b5e0ae9ffabeb00.bin.zip
Password: infected
-
2c18edd3f0c6914aee3137e19d341010c033394e23a62dea9dea3f4df30d3c68.tar.tar
Password: infected
-
Purchase Inquiry.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ