Behavioral task
behavioral1
Sample
informe_payload.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
informe_payload.exe
Resource
win10v2004-20240419-en
General
-
Target
PDF-EXPLOIT.zip
-
Size
206KB
-
MD5
b621859eed4b3e0cd52ea9c354760690
-
SHA1
af729bcc3574ab61ccc52a26f48dd1c59a482470
-
SHA256
1407e6555895344dc050f0c4bda95a93c3703f0e94a8a1b64fa55b17f08d6182
-
SHA512
a657e860b5b38592841ea9a7aa56d2ca4f67249490f95543b50122b36bedec23ffaf3d7517c85c558ca15e0b5a5a3dafcb648f4a7e22aacc537f02c5e9eaa63c
-
SSDEEP
3072:e4WZEMV+vrLR4YvQmGphyqsQFtV/nrgHc0l8BUarr36Zd+GyQVwyD/rvkQ5IfFNW:eZZENF7g95L/rgHv+qarr6HVwy+LWYer
Malware Config
Signatures
-
PDF contains JavaScript
Detects presence of JavaScript in PDF files.
-
PDF contains one or more embedded files
Detects presence of embedded files in PDF files.
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack003/informe_payload.pdf
Files
-
PDF-EXPLOIT.zip.zip
Password: qm
-
PDF.rar.rar
Password: qm
-
analisis.pdf.pdf
Password: qm
-
http://maldev.pcte.co
-
-
informe_payload.pdf.exe windows:4 windows x86 arch:x86
Password: qm
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 893B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 836B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ