Static task
static1
Behavioral task
behavioral1
Sample
Price.Pdf_____________________________________________________________.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Price.Pdf_____________________________________________________________.exe
Resource
win10v2004-20231215-en
General
-
Target
ac0258ee62a0b015c7bf1b56c626ed71
-
Size
149KB
-
MD5
ac0258ee62a0b015c7bf1b56c626ed71
-
SHA1
d79fed4c4f2b12d848f554c261eea2ab99319e88
-
SHA256
83501ac636445618393d331d2a07cec9d0b67cd93c8c05f702cb532ac054ef64
-
SHA512
70c53f204ef8269d3eebf09b248316dbd4d7c1f040e325a48e15abac7a2b6e9a5511b13647833752278d9813d1bb81a2abb05097eb10e57a12dd724c967b2a62
-
SSDEEP
3072:/J3vARo5C7grM3hP3UL9QPbOSZ6KgT2vGhxEuYRoioBsHszSvu:/lD5CZx3UL9+bOXKyf/iQsH4Svu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Price.Pdf_____________________________________________________________.exe
Files
-
ac0258ee62a0b015c7bf1b56c626ed71.zip
-
Price.Pdf_____________________________________________________________.exe.exe windows:5 windows x86 arch:x86
1c905d3d4c93b0360c86a969e3123c38
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlUnwind
NtQueryInformationFile
NtClose
NtReadFile
NtWriteFile
shlwapi
PathCombineW
kernel32
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
SetLastError
TlsFree
DecodePointer
GetCurrentProcess
GetTickCount
GetCurrentThread
GetProcessHeap
GetProcessTimes
GetCurrentThreadId
GetCurrentProcessId
GetThreadTimes
HeapReAlloc
HeapAlloc
InterlockedIncrement
InterlockedDecrement
HeapFree
InterlockedCompareExchange
HeapDestroy
HeapCreate
HeapSize
MultiByteToWideChar
SetUnhandledExceptionFilter
CreateDirectoryW
GetFileAttributesW
CreateFileW
GetLastError
SetFileAttributesW
GetModuleHandleW
GetProcAddress
LocalFree
GetFileType
GetSystemTimeAsFileTime
GetVersionExW
GetThreadContext
SetThreadContext
CreateProcessW
VirtualFreeEx
TerminateProcess
GetModuleFileNameW
VirtualProtectEx
VirtualAllocEx
WriteProcessMemory
ResumeThread
CreateThread
CreateMutexW
IsProcessorFeaturePresent
InitializeCriticalSection
Sleep
LeaveCriticalSection
OpenMutexW
EnterCriticalSection
CreateEventW
DeleteCriticalSection
WTSGetActiveConsoleSessionId
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
LCMapStringW
GetStringTypeW
LoadLibraryW
GetNativeSystemInfo
WaitForSingleObject
HeapSetInformation
GetCommandLineA
user32
GetFocus
GetCapture
GetKBCodePage
GetForegroundWindow
GetDesktopWindow
GetActiveWindow
GetShellWindow
GetOpenClipboardWindow
GetClipboardOwner
advapi32
RegCloseKey
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExW
shell32
SHGetFolderPathW
ShellExecuteExW
ord680
ole32
CoInitializeEx
Sections
.text Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ