Water_Adobe_Scan_Feb_27_2024.pdf
- SHA256 6b87d771156f68d09093d798abb1abd7fa4c1f951affb629c1ee3cf2e423fb6d
-
Unsigned PE
Checks for missing Authenticode signature.
Behavioral task
behavioral1
Sample
Water_Adobe_Scan_Feb_27_2024.pdf
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Water_Adobe_Scan_Feb_27_2024.pdf
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
Water_Adobe_Scan_Feb_27_2024.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Water_Adobe_Scan_Feb_27_2024.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target Water_Adobe_Scan_Feb_27_2024.pdf
- Size 1011KB
- Sample240229-2dp9fsec8w
- SHA256 6b87d771156f68d09093d798abb1abd7fa4c1f951affb629c1ee3cf2e423fb6d
- MD5 79c9682e3d336e6fe8def3c4d33e5b29
- SHA1 aaf833f0e5f620a8b84d7790d62d5c9cc0e64aa4
- SHA512 5338d354704813bb476afba55fa37a70be90f28fce56bc53390dc97f69c071a423df0f94bf3e6ec66b90f0c85b1cab60b907c18945cc9d39f8270b4c2e998cad
- SSDEEP 12288:BMfmSu1qUHH0UQNCGf6ryEoX1MWV0NkeSmWKyLbLI6HVvjzx5nEsBCqdJX2G/7+h:B5DUSaXFFBQOzxlEsBl+ZpC8q8
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- PDF contains JavaScript
Detects presence of JavaScript in PDF files.
- PDF contains one or more embedded files
Detects presence of embedded files in PDF files.
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Water_Adobe_Scan_Feb_27_2024.pdf
File Explorer
-
Water_Adobe_Scan_Feb_27_2024.pdf.pdf 1011KB
-
Water_Adobe_Scan_Feb_27_2024.pdf.exe 120KB
-
pageEntities.json86B
Water_Adobe_Scan_Feb_27_2024.pdf
- IMPHASH 34698fc4be5103843b28a27b2ff5c9c8
- SHA256 ca26ea8e59fe41773d2b3652449ec3fc6a73edd6413b3109d2a7f04712ddc05b
- MD5 1541e0bb046d31ba7eaa2fbf606df09c
- SHA1 de9c548823391fbcc02d598da5ee703d655005f7
- SHA512 4dd80e31f75d2d75f1dfcb74cc060863bef7541d455abdba4531e4fa5f622127f4f5369b49bdea79a79dcac4ca6cddda82e37f541b249f22de3000b1e7494561
- SSDEEP 1536:/zjoAkSVRoidt3NIEzK1I0ZjwZ61cBsYvIch8RwW0IHAufngu5Nr2O1vHkt9um:/HuSVKidFNI1ZRqORp4ufFm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeConsole
GetLastError
InitializeCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
_initterm
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
signal
strlen
strncmp
vfprintf
shell32
ShellExecuteA
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1024B
Virtual Size
528B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
396B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
1024B
Virtual Size
707B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/97
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/113
Size
512B
Virtual Size
405B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
pageEntities.json
- SHA256 cff4d196809df24521e53c06a00c0795704529c898af29bdf09306baf8cb05dd
- MD5 f7ef81016079c8af44663197421faab2
- SHA1 d519ff4878d3ba428b3696aa8a56502c56e86e52
- SHA512 1ba6be0ad10825dcf8f9adeec2a6930c081ae0fa234fc9a2dfde4e0b6be2e093cf57366230ad4255314e47b67f8cee1a0659b55c73777880f625fba0ba17ff29
- MD5 SHA1 SHA512