Advance Payment[.]pdf[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Advance Payment.pdf.rar
Size

567KB
MD5

6ba62ef43da498555f56774e2f530984
SHA1

1a6dafe4b16d7056f2c3a1520fb48d06cc147093
SHA256

830fbd5895102d5e2c51ab9b884440dd2e53f13c53ff507b9e6909b71454a5ab
SHA512

92493df4b943e43bcb2fe9fd5de29ec2b4b14e1a1e912b531f89ef691a234a477ef20daea9bf1574e43899738b4376b32a496a5d87492f7b090a7c09149c9dbd
SSDEEP

12288:xgsbgoYrnQoxHtMguCQPxFTJVT1qwKdd/lYDoHbLQ0JxsLkLyF0UnyWG:asbdhKHt3IPtFGd/lYDC3BJxsLkWFg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Advance Payment.pdf.exe

Files

Advance Payment.pdf.rar
.rar
Advance Payment.pdf.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 609KB - Virtual size: 608KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ