Static task
static1
Behavioral task
behavioral1
Sample
Purchase order.exe
Resource
win7-20240221-en
General
-
Target
e2acdace07abd4ac568bf9e3649e4c6b.bin
-
Size
641KB
-
MD5
79d18e86d4403028a8d351dfd527132e
-
SHA1
57b0b415d36ed18f6397621964cfff3338c8d7f2
-
SHA256
f9a431c3ffa602cca9fdd63bc77f921fcd93ea561444ae3bddcf46e935fa525a
-
SHA512
82953bac36d801e8bc94ab54da8acbb5b189cfb62251e680f0ca0b1a1300f6d49c1e7d5ba39552e051209a216ed4f512354299d0a15a5db197ccc0f2ac0c52b9
-
SSDEEP
12288:7tqWUmbTBQlEnHfKY/5z0xX+P1tem6I5PTi2lRxNe6IxVzLY6/8Y:9UoB8FEauPHLE2lRxNelxVX3UY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Purchase order.exe
Files
-
e2acdace07abd4ac568bf9e3649e4c6b.bin.zip
Password: infected
-
f75cef2ca401714a35714b997352ec5c5034e37e2d8b58f38c493662ebf7b79a.zip.zip
Password: infected
-
Purchase order.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 842KB - Virtual size: 842KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 884B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ