BANKOVNÍ SWIFT pdf[.]exe

General

Target
BANKOVNÍ SWIFT pdf.exe
Size 882KB
Sample240517-h28adsfc84
SHA256 89a26e6594b2d773b6651bc805155fd2516e888336aeff9642ae5e835d31feed
MD5 3585f04cfe1b31b4695007ac4bc7675f
SHA1 b6fe8db56fc26b756f095ef4f989294474f23e83
SHA512 0c9006acaa2fe89fde6b90b59caa0f43a4e60391341cf04734054f9a7e0ed9ccae2115ecdc35a378744fdea832d87ebeec00a109657bc8585ea1f07bdd1c6dfc
SSDEEP 12288:kX9TgXF/OHYMhHQRD+Ba/7WWBEQKT+QuywpnwrqrAp3+qgLghS3lhKc3wfTRoIut:kX9tH9iRneOQIhw7W7BSKIj+fnBlGC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BANKOVNÍ SWIFT pdf.exe

File Explorer

BANKOVNÍ SWIFT pdf.exe

.exe 882KB

BANKOVNÍ SWIFT pdf.exe

IMPHASH 70229c3a1d4b2e17d3131a0bf773a764
SHA256 89a26e6594b2d773b6651bc805155fd2516e888336aeff9642ae5e835d31feed
MD5 3585f04cfe1b31b4695007ac4bc7675f
SHA1 b6fe8db56fc26b756f095ef4f989294474f23e83
SHA512 0c9006acaa2fe89fde6b90b59caa0f43a4e60391341cf04734054f9a7e0ed9ccae2115ecdc35a378744fdea832d87ebeec00a109657bc8585ea1f07bdd1c6dfc
SSDEEP 12288:kX9TgXF/OHYMhHQRD+Ba/7WWBEQKT+QuywpnwrqrAp3+qgLghS3lhKc3wfTRoIut:kX9tH9iRneOQIhw7W7BSKIj+fnBlGC
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

78044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTempPathA CloseHandle WaitForSingleObject Sleep CreateProcessA AllocConsole FreeConsole EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW SetEndOfFile RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap CreateFileW HeapSize WriteConsoleW RtlUnwind

Name

.text

Size

190KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

139KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

664B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

BANKOVNÍ SWIFT pdf.exe

kernel32

generic