Static task
static1
Behavioral task
behavioral1
Sample
Approved E-DO PDF.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Approved E-DO PDF.exe
Resource
win10v2004-20240419-en
General
-
Target
a1ec77271287f41a17afdabdc3d2269a.bin
-
Size
638KB
-
MD5
1bbc764f8d00d120d0bf1c9748825d0e
-
SHA1
a296db2339e6f51ab9227b15e50c76314d6ec1d6
-
SHA256
7a316d013e1222bf4cd97332497b8e62e2023cbc0648f9224ec0ac7dc0dd2375
-
SHA512
f1360d5ef37d9053357449addbd813e8ad5420aad82f0647f4fa4c34e71a36e9d648881103ae5d8947ebef374698f10720d2c98fbdc89b2828c975bef61b120a
-
SSDEEP
12288:+x/WjSP2845anaSaA/fETZI227o5jf6Ya1r7pLCgX/MdBHPe7oiSi4RDUgnz:+xu184InLyZIsJyYaZZCgXUdkolRRAgz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Approved E-DO PDF.exe
Files
-
a1ec77271287f41a17afdabdc3d2269a.bin.zip
Password: infected
-
21a6150f936a6e5a0771a0f1e9f4ee829c39de4f04d36c04eb5c2dace6e46987.rar.rar
Password: infected
-
Approved E-DO PDF.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 685KB - Virtual size: 685KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ