kVBN.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Purchase Order.exe
Resource
win10v2004-20240508-en
General
-
Target
05062024_0134_03062024_Purchase Order.7z
-
Size
641KB
-
MD5
a7e1450be4236fe467ceb0114a9d220b
-
SHA1
65c91f1846e3524d751ab8f03825de4bf9ee83c8
-
SHA256
7d008e40b5d0f8c5e6314b972414314bcc5531b91b054d6b6708fed5a7fd8473
-
SHA512
fedf269b769568028ea0574ca0f9c549abfa5d9d6cc12a17bcab91bc6d16dccb788f66cd379c07d7ac8984c1e9f71e659110b4d5c3b86a86fe98e9ee6b74b12b
-
SSDEEP
12288:PtzUV3oFYo9nNuqJhqlvOd+ONbKq06oslkdyXFffE:PtzUV3HoRNp6Od+ONG9I5fE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Purchase Order.exe
Files
-
05062024_0134_03062024_Purchase Order.7z.7z
Password: infected
-
Purchase Order.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 704KB - Virtual size: 704KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ