Static task
static1
Behavioral task
behavioral1
Sample
Confirmation of Payment.exe
Resource
win7-20240221-en
General
-
Target
1e5067740eb8cf48d8343d62fc3e4150d60db16f244996c931288cd522f266ba
-
Size
686KB
-
MD5
03da53dc0d8af13ffcbe6f15b92cfda7
-
SHA1
27586afc482a213418af187ac99c6416d0963747
-
SHA256
1e5067740eb8cf48d8343d62fc3e4150d60db16f244996c931288cd522f266ba
-
SHA512
e244aaf6073e327414be51d1beaa53ab3828410c36450c6f58201a9cd2959e84f05d72f425f9866cf3067c07f696343e574cd7f73f0a00ea21e9ed99c66e9de0
-
SSDEEP
12288:qxy0MPTlihBr7I1e5qMjgc58yY+cDgz8SyDU6NZRqmXw+tuXkPSPgAMfXP5OOX:YzMPTchBrMoqM1B5N4nRq6w+tu0PSoAm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack003/Confirmation of Payment.exe
Files
-
1e5067740eb8cf48d8343d62fc3e4150d60db16f244996c931288cd522f266ba.zip
Password: infected
-
dfbff3011cb624680480c2dbb5f2e82ea55c11aed6723d54cb653a4644aa3af0.gz
-
dfbff3011cb624680480c2dbb5f2e82ea55c11aed6723d54cb653a4644aa3af0.tar
-
Confirmation of Payment.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 738KB - Virtual size: 737KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ