04062024_1811_04062024_Purchase Order-P220601-001[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

04062024_1811_04062024_Purchase Order-P220601-001.rar
Size

646KB
MD5

be4a8152b6a50587e7896d9501f1d636
SHA1

cfe04afc3647fb0bb93d0e2e18cc476485c08dcf
SHA256

fde50f197fba1f8571d21b063b31447f9546a6becd5933f8abed5c042b42fda7
SHA512

a7807f5097a51918b04377fcafea220d89f6b3bf15320ff6863bf8512efe6203d6afb35dbe49d866f909321d617620b4e8eff1c4b88bbec57c1c79a64f74f66c
SSDEEP

12288:P0qgPhZ51JTBRDd8KplLINIC83bcjhX6uFvy/4pj78oyDuNH+SJrAeAlVa9BSBjx:OHhnRPpxINI93AdX66vyCj7/HtqV68Bd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Purchase Order-P220601-001.exe

Files

04062024_1811_04062024_Purchase Order-P220601-001.rar
.rar

Password: infected
Purchase Order-P220601-001.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

okSp.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 684KB - Virtual size: 684KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ