Static task
static1
Behavioral task
behavioral1
Sample
Invoice Ningbo.pdf.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Invoice Ningbo.pdf.exe
Resource
win10v2004-20230703-en
General
-
Target
Invoice Ningbo.pdf.7z
-
Size
945KB
-
MD5
9db0dd34172a4cd315758354b8fd6011
-
SHA1
87c9f96add7da9a9a063ab3c882751072c560ff5
-
SHA256
7354295320e83b03fd2d618e1156d2f33873e4edd22123c2d415eb38ca8f8cb2
-
SHA512
c21b5636a5e6aca82a61bd45cda4d952827fc79d68b490c3c5ccca28002bb60b6e766338907abffc589124bd0e8a306301ec1b4d28b01f64698994c8239f1877
-
SSDEEP
24576:ojhKFIoZfmdawpxV/cIJ0EVKTasxD+Pw4EoHV7bmTUdm1:ghWHmxwAKxxD+PlHVAUE1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Invoice Ningbo.pdf.exe
Files
-
Invoice Ningbo.pdf.7z.7z
-
Invoice Ningbo.pdf.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 804KB - Virtual size: 803KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 598KB - Virtual size: 597KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ