Static task
static1
Behavioral task
behavioral1
Sample
PO23043-WT0540500856808075.PDF.exe
Resource
win7-20230712-en
General
-
Target
0ecb1b6a3d685cca1c3e93880787bb58.bin
-
Size
534KB
-
MD5
9e4addc523cf8fd5785bb0a5791696fb
-
SHA1
63091e3a6f6a7eb48a6b371546a57a8a7a878f84
-
SHA256
78cc9a9e3a7ba819c60369a7f23fe4d36400632e98714a1d3cb6bc563c606a1f
-
SHA512
0f724b1b139ff66216f35c011330ac9d4e46cc1b1e14132bc6ad6dd11fbeb48238fc3189d8b015a9868200e6c90b5ea7e4d078721e7469c2974583e328374d1d
-
SSDEEP
12288:fAT1BND9m0EmsDG5OBSbwrmQCRvDvWN8Vb8/IkZ/rmSm2GJoQvOSjpQ:fkDzEmsCcDrHoE8Vb8vZ/22XQvLi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/PO23043-WT0540500856808075.PDF.exe
Files
-
0ecb1b6a3d685cca1c3e93880787bb58.bin.zip
Password: infected
-
f3a9767ed1de9ec00f8a260da650b3b0fcd63b96ce3406f4a1843dcbeb5bf034.img.iso
Password: infected
-
PO23043-WT0540500856808075.PDF.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 550KB - Virtual size: 550KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ