6602c260ce2f6e6c8d5ffb40c309bbb13ab7709da7d885ac2295bc9b4712d8a5.7z
- SHA256 6602c260ce2f6e6c8d5ffb40c309bbb13ab7709da7d885ac2295bc9b4712d8a5
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Doc320785506.exe
Resource
win7-20240508-en
windows7-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
Doc320785506.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
24 signatures
150 seconds
General
- Target 6602c260ce2f6e6c8d5ffb40c309bbb13ab7709da7d885ac2295bc9b4712d8a5.7z
- Size 27KB
- Sample240517-bybzfsbb2y
- SHA256 6602c260ce2f6e6c8d5ffb40c309bbb13ab7709da7d885ac2295bc9b4712d8a5
- MD5 90274f78333eb6682d27bd57513a90f9
- SHA1 ef45eb12fcabdf2e8183164c6c6cfb58dc035d5c
- SHA512 11690f43c0b2d83b2911cfc50b7942d26bae85d80cc0d495ba28e16b7ea35977a85c52d346d67151ede49772800bb10aa2685d852613655ce049f3fa73c1a5c0
- SSDEEP 768:0xOAB5n341ekkMWg6vi87M914dXS5Cn87rE0PF:WxIeLRq8MuXErP9
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects executables packed with SmartAssembly 1 IoCs
resource yara_rule static1/unpack001/Doc320785506.exe INDICATOR_EXE_Packed_SmartAssembly
File Explorer
-
6602c260ce2f6e6c8d5ffb40c309bbb13ab7709da7d885ac2295bc9b4712d8a5.7z.7z 27KB
-
Doc320785506.exe.exe 66KB
Doc320785506.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d920f54205824893b67562d371ea565dc2ae8f1dc02b6e2e079ff0ec246563e6
- MD5 40d4f9dce0a4c36281ac0fd748623f22
- SHA1 b4ac62a557b720a82a89f279aebf062247ed686b
- SHA512 3bbe8979e950d3d4810b762f18496d91f3a867300d65e638d268030255f1f805f7479a44903f29d7382390a0462872f9af259b8ff5177552f143c8dc20b80705
- SSDEEP 1536:uclZk2SFjwIcry68JT3KDJipMJQ2v83hGH:uclCw83JzK9kMJQ2vZH
- MD5 SHA1 SHA512 SSDEEP
-
Detects executables packed with SmartAssembly
PE Signature issue
Digest
65:43:bc:cf:fc:1c:a9:af:85:be:b3:69:0e:1c:90:8c:0b:b2:12:16:7e:a7:ea:8f:5d:ee:67:2d:4c:9f:e9:18
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=PDFescape,O=PDFescape,L=Encinitas,ST=California,C=US
Chains
Jul 1, 2019
CN=PDFescape,O=PDFescape,L=Encinitas,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
55:5a:03:50:b4:24:20:de:ac:be:04:51:74:d9:17:9f:2c:0b:de:4f
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=PDFescape,O=PDFescape,L=Encinitas,ST=California,C=US
Chains
Jul 1, 2019
CN=PDFescape,O=PDFescape,L=Encinitas,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=PDFescape,O=PDFescape,L=Encinitas,ST=California,C=US
Serial Number
06:e2:87:08:44:b5:fe:91:7e:34:98:fd:25:26:fb:cd
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 8, 2019 - Jun 11, 2021
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=PDFescape,O=PDFescape,L=Encinitas,ST=California,C=US
Serial Number
06:e2:87:08:44:b5:fe:91:7e:34:98:fd:25:26:fb:cd
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 8, 2019 - Jun 11, 2021
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
4
Entry point
56670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ