Static task
static1
Behavioral task
behavioral1
Sample
Invoice Ningbo.pdf.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Invoice Ningbo.pdf.exe
Resource
win10v2004-20230703-en
General
-
Target
Invoice Ningbo.pdf.7z
-
Size
490KB
-
MD5
ea4484372aad013457c26eca399a9845
-
SHA1
9040fc60cd27b34fa54e78bb02d62718f1ab6bf6
-
SHA256
337e42e39d8612056eb0bc81526909d75f3582b4d9a1315e6dd82e71ac217666
-
SHA512
32d38d37a3a5833d96a672465c6aa257a2dc33c67bd24da53f90c5370e3a0e158c0ce18df031eb44e3528aedd52657acf695b55cd5e6ec7709c35658ec486be0
-
SSDEEP
12288:m3c2YU1o14ckF+u2eY7s/QWqO9VAVNen4f0MDnB:gcyo1SF+u2L7s/QWqO9VafxB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Invoice Ningbo.pdf.exe
Files
-
Invoice Ningbo.pdf.7z.7z
-
Invoice Ningbo.pdf.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 819KB - Virtual size: 818KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 174KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ