Static task
static1
Behavioral task
behavioral1
Sample
DHL Shipping Document.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
DHL Shipping Document.exe
Resource
win10v2004-20240508-en
General
-
Target
07062024_1623_07062024_DHL Shipping Document.pdf.tar
-
Size
593KB
-
MD5
229ac4ea35fac36504db5d0241dfba70
-
SHA1
089c6f69cf2b514e5efe5e383b1f9981be30413c
-
SHA256
df1077a97eec3c4173ca7735fadf94e94b70be5fedcc8b6326401ff158584606
-
SHA512
535c46c5b3fc012db0570822935c9647dd04709210a26dfead03934e06b1898d456bebd130647ff819f98d7b5a55bfc8928baa719a074deab6e2aaa2f5154cb1
-
SSDEEP
12288:Ce9YiEyNQ/GK1i34Vb7TY6EFMORUDFF7nnl:CmYifNQM346FNRIh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/DHL Shipping Document.exe
Files
-
07062024_1623_07062024_DHL Shipping Document.pdf.tar.rar
Password: infected
-
DHL Shipping Document.exe.exe windows:4 windows x64 arch:x64
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ