Postfix[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Postfix.zip
Size 4.8MB
Sample260705-rhnlbacy6v
SHA256 fc75e41980561aeb9d55c609bb2cc852d803130cd6962c584915789f0c2ac507
MD5 e41da197e20b598bc706750edd4a6de2
SHA1 8d4ca65bd7ff3283cfb117e758735cd82816b021
SHA512 4f447f96d8720748bd152b7ac066b3c6c1487deb40df819c6c7a234bdf1ab87d5b62628b0fa61d165d894b1de77be71c0356382ba84667fcc45aa2847828f00d
SSDEEP 98304:9ZRBsz8Jw902Q756s4exz4JSzrkEMTfiJULcrhYO+1NdremSR2OAA6Q:X/OD90ld64JeSzrkEs/crh8VremS4Q
TLSH
T1313633BD30012F4EC36946D097CDA46EBC5B361796C370C67CB1EA7E09ADAE62859730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Postfix.exe

File Explorer

Postfix.zip

.zip 4.8MB
Postfix.exe

.exe 11.4MB

Postfix.zip

SHA256 fc75e41980561aeb9d55c609bb2cc852d803130cd6962c584915789f0c2ac507
MD5 e41da197e20b598bc706750edd4a6de2
SHA1 8d4ca65bd7ff3283cfb117e758735cd82816b021
SHA512 4f447f96d8720748bd152b7ac066b3c6c1487deb40df819c6c7a234bdf1ab87d5b62628b0fa61d165d894b1de77be71c0356382ba84667fcc45aa2847828f00d
SSDEEP 98304:9ZRBsz8Jw902Q756s4exz4JSzrkEMTfiJULcrhYO+1NdremSR2OAA6Q:X/OD90ld64JeSzrkEs/crh8VremS4Q
TLSH
T1313633BD30012F4EC36946D097CDA46EBC5B361796C370C67CB1EA7E09ADAE62859730
MD5 SHA1 SHA512 SSDEEP TLSH

Postfix.exe

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 0e819084eb75f8f42ace9afe4a402db0f75e3021279ab2c0f9c0d2d6fd543f2e
MD5 6d0d28bce65293ead89fbfc8f61350d1
SHA1 33e0bc4ef686a9edf42056a72d5b28bb804f3512
SHA512 44b65fd1547390870c80e979e2fbd20d2d5627b2e8c07dc2bdb26cf8fae5dca27fb0fe6358ed27783090f421042a69762e50efadf3a19d612a05233007117fa5
SSDEEP 49152:dieHFqwnaz2m5re6phe9HMQlP4SIHa8WC+7HihaW8dJT5KfiNd/+CEPp3eV7IWT6:diEzahzSClaHfSxER/3t2AocZLruED
TLSH
T1B8C65947E8A545E9C0AED175CA269563BB703C884B3063D76B90F7242F73BD0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

558944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

679KB

Virtual Size

33.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

128KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Postfix.zip

Postfix.exe

kernel32

generic