Static task
static1
Behavioral task
behavioral1
Sample
Sanlev Satın Alma Siparişi_Q000040110E.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Sanlev Satın Alma Siparişi_Q000040110E.exe
Resource
win10v2004-20240508-en
General
-
Target
e6bdac3b0c45f1b32015e6472d70690a.bin
-
Size
627KB
-
MD5
c03b27cd415c8bc44997729040261bdd
-
SHA1
32dcd671f87c3364ee273a9fe9f97b957cba284c
-
SHA256
10c4a3483f46a3f4fdf803b0cbe5bde05c16913936486bde109e798502b80746
-
SHA512
6e7a6e22676a462216203c82e6285099e2ea4d19dc61d79ccca7773aee98315fb1681ed53dd2a0418e3cdb6ed98ae546306c5fdf411c9ccff6675f718b65a9c1
-
SSDEEP
12288:Xj521gstbU4K13RxTF34hsToJY2QC+lmBkEYafBxiEwgVK:XFQgstbBAHF3op+2QlmBkEYa5xfK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Sanlev Satın Alma Siparişi_Q000040110E.exe
Files
-
e6bdac3b0c45f1b32015e6472d70690a.bin.zip
Password: infected
-
e26aff8074a1b0d74411f6fef9b061f1e4b1d8dc52cf703da692a5ffc050e4e3.gz.rar
Password: infected
-
Sanlev Satın Alma Siparişi_Q000040110E.exe.exe windows:4 windows x64 arch:x64
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ