Static task
static1
Behavioral task
behavioral1
Sample
Payment Document.pdf.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Payment Document.pdf.exe
Resource
win10v2004-20230915-en
General
-
Target
mkpub_Payment Document.pdf.tgz
-
Size
620KB
-
MD5
3be568189aec20a310712d0f8186b002
-
SHA1
213e17bcc297b94a8a4ce44e2966f89db44cb5d1
-
SHA256
74cd940d1fbcacb2b70b46742d7fefeff7b66308dac2f16e169a87fd7bec9046
-
SHA512
f040ff64b49d503d6b5d1983cbad877b5d56d7ad9b6d87b778ff38cac13df38d34b57ac60126567a208a9ba082d9ac53f09b9a12700b501a0f943b187045cc06
-
SSDEEP
12288:YAC0WmquJfx6qooQDsP+uuZ49SAFQPQwpOeT+wAmN60IK2tSKfsGksRlH5Jid:R/Wmqu9QloQIPxFMF2NE1tsst2lZJi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Payment Document.pdf.exe
Files
-
mkpub_Payment Document.pdf.tgz.gz
Password: infected
-
sample.tar
Password: infected
-
Payment Document.pdf.exe.exe windows:4 windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 686KB - Virtual size: 686KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ