New Order[.]pif[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

New Order.pif.exe
Size

700KB
MD5

147240336f98a7fc1f2062c57816a27d
SHA1

483d614d7586bacfefe2b8b226f22ab056682d16
SHA256

fb3d82bb5d2ea0c9636a4d2eb6137cee81026f4b348eef7c9d269cbc346d1521
SHA512

0d78df31bc774077efa876f0f2641037f4900fcb100a42d03f7e549192dbdb4814d749a3b0bbfa81cf32561cbbeabc8c2b3dc2cc0ad029cbff8e9ae95e466a16
SSDEEP

12288:0zNwnqs3y44sAGk0fGQGCSqrPzOny+qTGU3ajf5HkD8Zm4tAN92fXoqq3AjLc8AY:pnPAGk0fl3FPzOBqTGjjxED83tqcAA30

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
New Order.pif.exe

Files

New Order.pif.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

FUwd.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 649KB - Virtual size: 648KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ