Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PAYMENT.exe
Resource
win10v2004-20240419-en
General
-
Target
0e8822f1e22de0c15830945bcb3ede1a.bin
-
Size
650KB
-
MD5
1aaa930f9d366f5c9bda5b60b37be663
-
SHA1
03a5b5899d6b60e3d905422b54036af1ad1d9432
-
SHA256
e43cb096bf64df823db720d7f921dbd6df44c4c2b1ca6f9c36841e7184ac1a6d
-
SHA512
094bb2ccfa768e5c805676053ae5c24ebf7a0c6eca7b2c7ceca0c8e7af930b16d1ff36bf87ebd287a4fbc110f816053a70a5022107145781cd6a841077f0330c
-
SSDEEP
12288:davAe6HAJrnsVR5TfOjB6Koy3TzM9B+oAntt6yYobJLEG+ZBBlwPVpPpYzn:gv6HWsV7qoKp3M9LYt4yJb5IZ6/PpYL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack003/PAYMENT.exe
Files
-
0e8822f1e22de0c15830945bcb3ede1a.bin.zip
Password: infected
-
de84a8494651f4bb2c06ba0aa94d0b239f0d8727a3050a907391dfd589c36952.gz.gz
Password: infected
-
de84a8494651f4bb2c06ba0aa94d0b239f0d8727a3050a907391dfd589c36952.tar
Password: infected
-
PAYMENT.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 667KB - Virtual size: 667KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ