MalwareBazaar[.]4 | Triage™

General

Target
MalwareBazaar.4
Size 209KB
Sample240729-thgh4swejj
SHA256 8c8d6407b9e75b2cffe74d8b04eedb16551eccdf6c124a54845316baba218b62
MD5 8705dc20cd2d9391223fba1dfe2f6ca1
SHA1 ae98038f38b95a2cd87a29cf6453df61793af091
SHA512 db4f411dda5e860444ab9aefaf827dbd2b6dd8648a3c83b3638c8a6fedd513f6dddc21a0fc0c12ff9f43398dc4d589468996e4cf5ec04b29530f17da605ac8fe
SSDEEP 6144:ZAbnWDXrZCmObzkX9goDt0+V058gZevGrL:ZRCm4e9gqqOM8gZeOL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Payment Prove for Invoice No.126789.exe

File Explorer

MalwareBazaar.4

.lzh 209KB
Payment Prove for Invoice No.126789.exe

.exe 218KB

MalwareBazaar.4

SHA256 8c8d6407b9e75b2cffe74d8b04eedb16551eccdf6c124a54845316baba218b62
MD5 8705dc20cd2d9391223fba1dfe2f6ca1
SHA1 ae98038f38b95a2cd87a29cf6453df61793af091
SHA512 db4f411dda5e860444ab9aefaf827dbd2b6dd8648a3c83b3638c8a6fedd513f6dddc21a0fc0c12ff9f43398dc4d589468996e4cf5ec04b29530f17da605ac8fe
SSDEEP 6144:ZAbnWDXrZCmObzkX9goDt0+V058gZevGrL:ZRCm4e9gqqOM8gZeOL
MD5 SHA1 SHA512 SSDEEP

Payment Prove for Invoice No.126789.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 fd4dbce199d52440961eec1b4557d51014ff2ed2278466b84925eb5f7b38c13d
MD5 19c2e374a191ee18466c11cefeddbe75
SHA1 6a6b1d342f67705a05c3eda5f8121b76e4a72e04
SHA512 3a94415990bacc4cb8d9c68a1e65e0bfb999fd944e161a22d5709545919143ffa344f624a212347d76364653ed0e06fe320aaff43bbbba4bbadfdf7f6deb7dc1
SSDEEP 3072:BtvW1h07m6MfaxOhHwlzErARHTvpyJWA3l9MwO078PMznseowDGooqRJYuEK39uj:BtT7PMixWQlvDcJKwZXowbosYPK39u0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

224267

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

/home/pxnst/users/4/Stub/obj/Release/Order.pdb

MalwareBazaar.4

Payment Prove for Invoice No.126789.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

MalwareBazaar.4

Payment Prove for Invoice No.126789.exe

mscoree

dotnet