PURCHASE_ORDER_PDF[.]exe | Triage

Sharing

General

Target

PURCHASE_ORDER_PDF.exe
Size

409KB
MD5

5d7bc74a7f048e8c244bd69f01ccf57d
SHA1

a855c2016edff555fc68c2294f792d8d9f6dfd2d
SHA256

93a80d67b37cc6bd27ec07dce5fa342e920c3edef436e78c39c3641d6f6ed79e
SHA512

2d7515acce4f0c1717a9edc2f72d82db5d9e1fd14290f6a011cec20a4532060baf31db4ab4d57eff01ee94fd82398643ce327f2a0c4fc8509c81eb2b5198180e
SSDEEP

12288:rU9+PTM1L2zbnt3+GXs4xH5Y1h6/XdZzTq:rMoTMB2ntuaxZ2Wd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PURCHASE_ORDER_PDF.exe

Files

PURCHASE_ORDER_PDF.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\Documents\CryptoObfuscator_Output\VBXCJD.pdb

Sections

.text
Size: 407KB - Virtual size: 406KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ