IMG0002000020[.]PDF[.]z

General

Target
IMG0002000020.PDF.z
Size 1.1MB
Sample261030-ncb4jsyscw
SHA256 c45981668aba10e0ee156173cbb7597fa12689807d2fdf5539c3afc093b87402
MD5 bde1610c8fc6bd9b63aa5679fd30e6a7
SHA1 0a1e8892a7972021f5e0327b1dac794d7d3aa11d
SHA512 84a66346b537207c20ca3e05a09f2ada4886623da108009921e9ecc7dac9b1f9eebdd8b9273d0f71a2567af5edc252c4c9c0ce56f5627b625df2c0d4ea028656
SSDEEP 24576:rPosiALPmJy22IyT9Bgvb+PeslMCEjOOMIS6K+loyxz4yA4wJcMFBT:MsFOJFvGXlMcOMI7K4j6vT
TLSH
T1F3353332615A118F568480BB95CEE09C1FB31D175C68CAFBF4B8F1B5E9552C0CEAA78C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0002000020.PDF.scr

File Explorer

IMG0002000020.PDF.z

.zip 1.1MB
0002000020.PDF.scr

.exe 1.2MB

IMG0002000020.PDF.z

SHA256 c45981668aba10e0ee156173cbb7597fa12689807d2fdf5539c3afc093b87402
MD5 bde1610c8fc6bd9b63aa5679fd30e6a7
SHA1 0a1e8892a7972021f5e0327b1dac794d7d3aa11d
SHA512 84a66346b537207c20ca3e05a09f2ada4886623da108009921e9ecc7dac9b1f9eebdd8b9273d0f71a2567af5edc252c4c9c0ce56f5627b625df2c0d4ea028656
SSDEEP 24576:rPosiALPmJy22IyT9Bgvb+PeslMCEjOOMIS6K+loyxz4yA4wJcMFBT:MsFOJFvGXlMcOMI7K4j6vT
TLSH
T1F3353332615A118F568480BB95CEE09C1FB31D175C68CAFBF4B8F1B5E9552C0CEAA78C
MD5 SHA1 SHA512 SSDEEP TLSH

Password

82104210

0002000020.PDF.scr

IMPHASH 99ee65c2db82c04251a5c24f214c8892
SHA256 0e2a4abde089b98cb0b129102669253731e52865a42c655abf2bf5023f6d4dfd
MD5 04e46cd935a06723b1b24e24684022a4
SHA1 d1baa7b34e46d8c6b3599f474d4e7a56a8c12fb3
SHA512 97a9ff2eabce58d5f202380f4a8d0d186bde7cba80c6e662e9a3da9fb0b0fd25b2dec1c58413a771496e007c463ef2cf87b18709cfea797b0e94b0396b9be8da
SSDEEP 24576:KN/BUBb+tYjBFHEPxZsc8gKWzVq3YsxGx+X1zJ54D+qN5/:6pUlRhSE2K8q3YsxXX1zJ5w+Y
TLSH
T1BE451212BBC080B2D57325351BB657912A7C79302F66CADF23E06DAE9A315C0D636F63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

82104210

Minor OS version

1

Major OS version

5

Entry point

157136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

kernel32

LocalFree GetLastError SetLastError FormatMessageW GetCurrentProcess DeviceIoControl SetFileTime CloseHandle RemoveDirectoryW CreateFileW DeleteFileW CreateHardLinkW GetShortPathNameW GetLongPathNameW MoveFileW GetFileType GetStdHandle WriteFile ReadFile FlushFileBuffers SetEndOfFile SetFilePointer GetCurrentProcessId CreateDirectoryW SetFileAttributesW GetFileAttributesW FindClose FindFirstFileW FindNextFileW InterlockedDecrement GetVersionExW GetModuleFileNameW SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW FoldStringW GetModuleHandleW FindResourceW FreeLibrary GetProcAddress ExpandEnvironmentStringsW ExitProcess SetThreadExecutionState Sleep LoadLibraryW GetSystemDirectoryW CompareStringW AllocConsole FreeConsole AttachConsole WriteConsoleW GetProcessAffinityMask CreateThread SetThreadPriority InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateEventW CreateSemaphoreW GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToLocalFileTime LocalFileTimeToFileTime FileTimeToSystemTime GetCPInfo IsDBCSLeadByte MultiByteToWideChar WideCharToMultiByte GlobalAlloc LockResource GlobalLock GlobalUnlock GlobalFree GlobalMemoryStatusEx LoadResource SizeofResource GetTimeFormatW GetDateFormatW GetExitCodeProcess GetLocalTime GetTickCount MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW GetCommandLineW SetEnvironmentVariableW GetTempPathW MoveFileExW GetLocaleInfoW GetNumberFormatW DecodePointer SetFilePointerEx GetConsoleMode GetConsoleCP HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW QueryPerformanceFrequency GetModuleHandleExW GetModuleFileNameA GetACP HeapFree HeapAlloc GetStringTypeW HeapReAlloc LCMapStringW FindFirstFileExA FindNextFileA

oleaut32

SysAllocString SysFreeString VariantClear

gdiplus

GdipAlloc GdipDisposeImage GdipCloneImage GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCreateHBITMAPFromBitmap GdiplusStartup GdiplusShutdown GdipFree

Name

.text

Size

233KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

IMG0002000020.PDF.z

0002000020.PDF.scr

kernel32

oleaut32

gdiplus

generic