Static task
static1
Behavioral task
behavioral1
Sample
Shipping Documents.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
Shipping Documents.exe
Resource
win10v2004-20231023-en
General
-
Target
b92f592c56d52d960cc9215c5e72aad8.bin
-
Size
1.4MB
-
MD5
6aba8ef4f8f56ce381b389f2c5bbc379
-
SHA1
362ad9d84e7255d8c623d7b77a2c3025a1cb1181
-
SHA256
e4960467f26b430c8fd6e1e4ae54fd4e5ee97f551a07582671bb0c6bebd7c6ea
-
SHA512
76113412f6fcc62985d414898156f4aa972eb6f41e841664bdb56ea3231af87f11b4a48c8c5c1d59ac0e8cedd93f88c48472865772a8dd6e40a38a20c5ae6d94
-
SSDEEP
24576:0KRMBU8hjRg5/fgb8wkG/O3QWREKmWYhw1OsknN5DzIlywU4SJAWNP7X28e:J78ZS5/SXWREKzPS5z0K4SJAwDC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Shipping Documents.exe
Files
-
b92f592c56d52d960cc9215c5e72aad8.bin.zip
Password: infected
-
7649ad4f79c1c15e03248b7262cd6b516f19f6ca8987fa76695b9b817318050e.zip.zip
Password: infected
-
Shipping Documents.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ