TWGR000956198[.]PDF[.]exe[.]zip

General

Target
TWGR000956198.PDF.exe.zip
Size 1.5MB
Sample260807-kdrnva1alg
SHA256 288dfad87c0d4e4f7bf076efd77df3691bf45eeaca7f3f5b430dd6b48d2ebcee
MD5 600cb1c7d7a93a7f84d7e4d84a71d90f
SHA1 4635c8475095480fcd628ddb79e094e1505805d4
SHA512 62ae02c0ba5458b807c2252f086512c842639057aa4e1a49fac001a1e0674a7386af5e85a14c0a63250be91eaaee9826fba50434e6037e94f5ccd1790d799a49
SSDEEP 49152:b98yF5qAD/J2rU1ne3WCVwIgwAdNZZEbxDVRJ:blDqiAcnHawID+NDEbN/J
TLSH
T13D7533AAF728D95A0F31E18C0E5944ECE28E9DF21005D6A7257D5EA648F9BCF17893C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/TWGR000956198.PDF.exe.bin

File Explorer

TWGR000956198.PDF.exe.zip

.zip 1.5MB
TWGR000956198.PDF.exe.bin

.exe 1.6MB

TWGR000956198.PDF.exe.zip

SHA256 288dfad87c0d4e4f7bf076efd77df3691bf45eeaca7f3f5b430dd6b48d2ebcee
MD5 600cb1c7d7a93a7f84d7e4d84a71d90f
SHA1 4635c8475095480fcd628ddb79e094e1505805d4
SHA512 62ae02c0ba5458b807c2252f086512c842639057aa4e1a49fac001a1e0674a7386af5e85a14c0a63250be91eaaee9826fba50434e6037e94f5ccd1790d799a49
SSDEEP 49152:b98yF5qAD/J2rU1ne3WCVwIgwAdNZZEbxDVRJ:blDqiAcnHawID+NDEbN/J
TLSH
T13D7533AAF728D95A0F31E18C0E5944ECE28E9DF21005D6A7257D5EA648F9BCF17893C0
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

TWGR000956198.PDF.exe.bin

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a8efe4ee25da7ed2f6255f18f3db86e0a204c7b4a275e57bcfc9a6adf3c52532
MD5 531962f97a5f6ae7580f8d895d9177f9
SHA1 ddd0d82daf6548bf6b6d92aafbeded924ec8ee4d
SHA512 c7b4a645c3c1bfd0b7c02b78ca6af3e87bceab6c06a26cbc1724236c472ee21c4e7df0ea2f08359a460f56475877a8270a7114eb5f2625470f2fc41a0a40bda1
SSDEEP 49152:gxSwcvnjqj1WjFnftb6OSn/5Ydgn4CLHfWDZkrrb:gxTcvnjqjcZh63ENtkr
TLSH
T12D751258164FC816C8934F7549A0E3B416B48F58A522C30BAEFE7EAB792F75A2C447C1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

1672158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

UEqw.pdb

TWGR000956198.PDF.exe.zip

TWGR000956198.PDF.exe.bin

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

TWGR000956198.PDF.exe.zip

TWGR000956198.PDF.exe.bin

mscoree

dotnet