eRpb.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ADVANCEPAYMENT.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ADVANCEPAYMENT.exe
Resource
win10v2004-20240802-en
General
-
Target
ADVANCEPAYMENT.IMG
-
Size
1.2MB
-
MD5
408312b581e3181eda6a583b40b3275c
-
SHA1
7351649523b154049ca1e7a26e7da1f13165b3c9
-
SHA256
a4732b87e3ae8ff4a16e41dce6dd42ede63701f6182bd38487e8c21d82f003de
-
SHA512
a871da48e767c6c8dea83dceabf557f1a681c33c5faf057a44b569483d28dd2837269b781fef1777f79cae13679ad5907069574358346ceb374b2d1146f55053
-
SSDEEP
12288:W9inCwgqaVour8qOBKBE9E07NbiLvO4/Nk+u1atcXuRIxk6:W9wC/qaSuroKBExZGlNk51atzkk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/ADVANCEPAYMENT.exe
Files
-
ADVANCEPAYMENT.IMG.iso
-
out.iso.iso
-
ADVANCEPAYMENT.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 551KB - Virtual size: 551KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ