df9a54881d2ddaf302ed481e7fc7f5a1
- SHA256 22147dc4db0fbb2e9dfa8632f2a641c3510c208da9b821cde79a8e509838e5c5
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PAYMENT-INVOICE-OVERDUE98878787-EXEL.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
- Target df9a54881d2ddaf302ed481e7fc7f5a1
- Size 158KB
- Sample240326-tzd5baeb72
- SHA256 22147dc4db0fbb2e9dfa8632f2a641c3510c208da9b821cde79a8e509838e5c5
- MD5 df9a54881d2ddaf302ed481e7fc7f5a1
- SHA1 b00d24913076bfc4e8f545eb20356ea6330ab8dd
- SHA512 94aea410e1c32e6c286a4f16ffd6ab0d96af90edef951917deb990c105a553ed9cae4af3eabaf8dd58a82504f211a4bb0134c7ef9c96986c1dcfd1a4fe0a5b05
- SSDEEP 3072:SA5umrT50bT3iwP8G7Zhn4ENoC8NWtVBGqJnFs51Z/s8OUyMhGiWxoLgQj:SA9Sb7ioBb4uR2WtLS1Z/s8O28xoj
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PAYMENT-INVOICE-OVERDUE98878787-EXEL.exe
File Explorer
-
df9a54881d2ddaf302ed481e7fc7f5a1.rar 158KB
-
PAYMENT-INVOICE-OVERDUE98878787-EXEL.exe.exe 318KB
PAYMENT-INVOICE-OVERDUE98878787-EXEL.exe
- IMPHASH fb599da96ec68b816a7f084ae9468b50
- SHA256 a42fdf3685f82a662136a36099ba05ef38d2282fac999ce29d4dc183f8bfb01a
- MD5 d1fab92d9a0b56af8b93dcad4a8ebe35
- SHA1 829796e4d2bbc09627eb498e61d6e48daf273095
- SHA512 1411c30ef43a5a4de232374057eeec6e7739e32f824535051dac1faf5a9971fcbb9467959e0fb8b134ec8baea98079f60d83da29c145396c5fbb1460d29d0cea
- SSDEEP 6144:Ez4q0llllllllllJTPFSoPZsesGA14bFAI1uWv7CWwPaAF:EXQTPQoBsesGycF1Pv7wPaAF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
9982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetFileType
SetStdHandle
LCMapStringW
CompareStringW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetStringTypeW
HeapAlloc
GetProcessHeap
CloseHandle
GetACP
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
WriteFile
GetStdHandle
RaiseException
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapReAlloc
LeaveCriticalSection
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
EnterCriticalSection
LoadLibraryW
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
CreateFileW
comdlg32
PageSetupDlgW
GetFileTitleA
GetOpenFileNameA
GetFileTitleW
ChooseFontA
PrintDlgW
GetSaveFileNameW
PageSetupDlgA
CommDlgExtendedError
ole32
OleSave
CoDisconnectObject
OleIsCurrentClipboard
StgCreateDocfile
ReadStringStream
CreateStreamOnHGlobal
HGLOBAL_UserFree
OleDraw
OleGetIconOfClass
HMETAFILEPICT_UserMarshal
CreateGenericComposite
CoMarshalHresult
HMENU_UserFree
OleConvertIStorageToOLESTREAMEx
CoCreateGuid
CoCopyProxy
CoReleaseServerProcess
CoTaskMemFree
HACCEL_UserMarshal
OleLoadFromStream
CoSetProxyBlanket
HPALETTE_UserMarshal
ws2_32
getpeername
WSAInstallServiceClassA
ioctlsocket
WSAHtonl
WSAAsyncGetHostByAddr
WSAAddressToStringA
WSACreateEvent
WSALookupServiceNextA
WSAInstallServiceClassW
WSAJoinLeaf
listen
WSASocketA
accept
WSASetBlockingHook
WSASend
WSASendTo
WSAAsyncGetProtoByNumber
inet_addr
msacm32
acmDriverClose
acmFilterChooseA
acmFilterTagEnumA
acmFormatChooseW
acmFilterDetailsW
acmFormatEnumA
acmFormatEnumW
acmFormatTagEnumW
acmDriverAddA
acmStreamPrepareHeader
acmFilterTagDetailsW
acmFormatTagEnumA
acmDriverOpen
acmDriverDetailsW
acmFormatTagDetailsW
msvfw32
ICDrawBegin
DrawDibOpen
GetOpenFileNamePreview
MCIWndCreateA
MCIWndCreate
avifil32
EditStreamPaste
EditStreamSetInfo
AVIStreamFindSample
AVIFileInfoW
AVIStreamOpenFromFileA
AVIStreamLength
AVIGetFromClipboard
AVISave
AVIStreamWrite
avicap32
videoThunk32
Name
.text
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
29KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
207KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=121, id=243, version=40116,
count=24, id=242, version=40116,
count=18, id=259, version=26706,
count=36, id=261, version=26706,
count=17, id=260, version=26706,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=164, id=1, productName=Unmarked objects,
count=1, id=260, productName=VS2017 v15.8.5 build 26732, version=26732,
count=1, id=255, productName=VS2017 v15.8.5 build 26732, version=26732,
count=1, id=258, productName=VS2017 v15.8.5 build 26732, version=26732,