Payment Confirmation[.]tgz | Triage

Sharing

General

Target

Payment Confirmation.tgz
Size

1.2MB
MD5

512531a51eba86d14b665d32a0d20662
SHA1

1dd33a7ff3d6c92be245189152cdf0253240a49a
SHA256

f1dfab54f1c84e55cab037422b7010d131e47e9e456cacc0e9eaabd42f6d559f
SHA512

cf5cadbeb38291e4292566f88fa7994cd1d0864c1bc9807bccbdeaff66cec088ef35e73191791523ea62121eb82727ed13936a04973793b744561a1384b7d9d1
SSDEEP

12288:j9PnLKIX9GelxTYU8PDbKhzku5KbfsbHz+CJ+yyQFNwGiCwvqAAioDV9pDR:RfncecJPuR+yjW3AlDVrR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Payment Confirmation.exe

Files

Payment Confirmation.tgz
.gz
sample
.tar
Payment Confirmation.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 662KB - Virtual size: 661KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ