_3719032_Inv0ice_Receipt-1-[.]iso

General

Target
_3719032_Inv0ice_Receipt-1-.iso
Size 532KB
Sample260909-akbabsab74
SHA256 175e9f2059d2732cc6cd5942d67a77982ecadf1c113688406f31c6cdeef6a478
MD5 bd321a22ff9187c473dc7847302e9850
SHA1 c199084a0f743d2ed387ad8a4fd223ea60ee4ab4
SHA512 28c176de34d37869119e791a6e5e4d0359393fe43674d795050bc4d1ae76e8d1f7e98854c198650bab50918660b10a8ea7de31a57237c0c9b2a99c63a4ff608c
SSDEEP 1536:E+IJ2iRB4aZnKZV4MJW0FijxOMr2rS78xSBAgljPOwcAdcQErj4rgOTOYrT3gL69:EfMaZnzGJj4rSYyS8wwydD
TLSH
T10FC4E7173654D1EEC16F88B1CE85A38D826B7CBDAF9151037FCE334E873A442AA55316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/_3719032_Inv0ice_Receipt.exe

File Explorer

_3719032_Inv0ice_Receipt-1-.iso

.iso 532KB
out.iso

.iso 532KB
_3719032_Inv0ice_Receipt.exe

.exe 472KB

_3719032_Inv0ice_Receipt-1-.iso

SHA256 175e9f2059d2732cc6cd5942d67a77982ecadf1c113688406f31c6cdeef6a478
MD5 bd321a22ff9187c473dc7847302e9850
SHA1 c199084a0f743d2ed387ad8a4fd223ea60ee4ab4
SHA512 28c176de34d37869119e791a6e5e4d0359393fe43674d795050bc4d1ae76e8d1f7e98854c198650bab50918660b10a8ea7de31a57237c0c9b2a99c63a4ff608c
SSDEEP 1536:E+IJ2iRB4aZnKZV4MJW0FijxOMr2rS78xSBAgljPOwcAdcQErj4rgOTOYrT3gL69:EfMaZnzGJj4rSYyS8wwydD
TLSH
T10FC4E7173654D1EEC16F88B1CE85A38D826B7CBDAF9151037FCE334E873A442AA55316
MD5 SHA1 SHA512 SSDEEP TLSH

_3719032_Inv0ice_Receipt.exe

IMPHASH ef3844a2ae80dd3854b261d20c091ee0
SHA256 362d33aa58d25ba8c59ac3d3def342d1ab5c1f38cf51a5880aaba4f07a04cb28
MD5 84a24a81863b83c0f240812368f0b99b
SHA1 9d77c0e6aae27fe5fdb5b30363ec4a104e1d3387
SHA512 7edeb15d4079cb19d472d2132280594094b18702aea60fd4499ec3d495a45215f426efbb20d4317f3fc7ffd48d64add450a614e4aa950dfefaecb98d63924cf6
SSDEEP 1536:D+IJ2iRB4aZnKZV4MJW0FijxOMr2rS78xSBAgljPOwcAdcQErj4rgOTOYrT3gL69:DfMaZnzGJj4rSYyS8wwydD
TLSH
T125A4E7173694D1EEC56F88B1CE86A3CD826B7C7DBF8151037FC2334E9739442AA55226
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

_CIcos _adj_fptan __vbaVarMove __vbaHresultCheck __vbaFreeVar __vbaLenBstr __vbaStrVarMove ord589 ord696 __vbaFreeVarList _adj_fdiv_m64 __vbaFreeObjList _adj_fprem1 ord628 ord552 ord661 __vbaHresultCheckObj ord556 _adj_fdiv_m32 __vbaAryVar ord559 __vbaAryDestruct ord669 ord593 ord594 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord708 _CIsin ord631 __vbaChkstk ord526 EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp __vbaVarTstEq __vbaAryConstruct2 __vbaI2I4 ord564 ord673 _adj_fpatan ord675 ord678 EVENT_SINK_Release __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface ord710 __vbaExceptHandler _adj_fprem _adj_fdivr_m64 __vbaVarErrI4 ord608 __vbaFPException ord537 _CIlog __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaVarSetObj __vbaI4Str ord574 __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord100 ord689 ord610 ord611 __vbaVarAdd __vbaVarDup __vbaStrComp ord613 __vbaFpI4 _CIatan __vbaStrMove __vbaAryCopy __vbaUI1Str ord619 _allmul ord652 ord545 _CItan ord546 _CIexp __vbaFreeStr __vbaFreeObj

Sharing