DOC_9684564656Purchase Order[.]exe[.]zip

General

Target
DOC_9684564656Purchase Order.exe.zip
Size 338KB
Sample260818-vwegcaad83
SHA256 3900b5e183b245e434d8aa44d6d9c0860e47520837a8218d1c37aae13b8fe0bf
MD5 5d62667f4a98755113209a8b1250573a
SHA1 3c90ecb8bab3ddd40003ee92ed70e227c3e1a195
SHA512 54525dc9082e3220fccd53ae5fb0115c35d72e186a45f3d80c24ab7cb8f0ab703a756b77aac25ae30095d12a7077fef8c944021854edff82e3f0b27fa4ddf9ab
SSDEEP 6144:YjNk3Fi2nIFdjBlTZd41KALv0Va/IC6uPhjdBjv3q2XyYX18VhkvnCERX:e0F9IFdrlA6arpjDv1X5X16kPrX
TLSH
T130742257FFC083AE3E67CB93A04C8C5E765A25855DEA7C70898C96BFC444F3985AAC04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/DOC_9684564656Purchase Order.exe.bin

File Explorer

DOC_9684564656Purchase Order.exe.zip

.zip 338KB
DOC_9684564656Purchase Order.exe.bin

.exe 500KB

DOC_9684564656Purchase Order.exe.zip

SHA256 3900b5e183b245e434d8aa44d6d9c0860e47520837a8218d1c37aae13b8fe0bf
MD5 5d62667f4a98755113209a8b1250573a
SHA1 3c90ecb8bab3ddd40003ee92ed70e227c3e1a195
SHA512 54525dc9082e3220fccd53ae5fb0115c35d72e186a45f3d80c24ab7cb8f0ab703a756b77aac25ae30095d12a7077fef8c944021854edff82e3f0b27fa4ddf9ab
SSDEEP 6144:YjNk3Fi2nIFdjBlTZd41KALv0Va/IC6uPhjdBjv3q2XyYX18VhkvnCERX:e0F9IFdrlA6arpjDv1X5X16kPrX
TLSH
T130742257FFC083AE3E67CB93A04C8C5E765A25855DEA7C70898C96BFC444F3985AAC04
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

DOC_9684564656Purchase Order.exe.bin

IMPHASH 2f33b931ff1d50f0cef09aafbe4eadc1
SHA256 bc6d99b1311f8ecb6b60ba7379c4ab9e568bc4f232d214eb23abfef555929efc
MD5 6497b852f5f51bdbcf1f226da72bdff5
SHA1 ea87fc294bad444edca8c8c5602543038a22e764
SHA512 8804b0f79a0c4b510bc1bdd4eb05f89de5f648faf1b33624d833fdeb82d08a4231e09b1f56e07ea8893d791e98ea667c0aa7bc28154941b8a970632ccf4f7b53
SSDEEP 12288:+q7pv9bdVNEY1FXZ/ByD+Hkp4D1kOsn5mY1qII:+upv9BVNh1Vc5w
TLSH
T17AB4E15A79447A84EECEDFB8C08A5E1EF5D8EB44C1CAAB14A2772503D0E314365CDF68
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

99:f6:c5:42:b6:c6:53:33:68:ab:66:f6:19:0d:0e:17:d1:9a:b5:86

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sveden software,O=Sveden Corp. (r),C=SV

Chains

Apr 1, 2019

CN=Sveden software,O=Sveden Corp. (r),C=SV

Minor OS version

0

Major OS version

4

Entry point

4284

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

DOC_9684564656Purchase Order.exe.zip

DOC_9684564656Purchase Order.exe.bin

PE Signature issue

msvbvm60

generic

Sharing

General

Malware Config

Signatures

File Explorer

DOC_9684564656Purchase Order.exe.zip

DOC_9684564656Purchase Order.exe.bin

PE Signature issue

msvbvm60

generic