Unpacking Fraudulent Fax: Dyreza Malware from Spam

The described sample has been delivered on 1 October 2015 at 17:33 CEST. The malicious sample is shipped as a ZIP-compressed. executable, pretending to be a PDF document. The payload belonging to the Dyreza malware family, a credential stealer. The following focuses on retrieving these payload files. The main file is 391476564964923647.exe the main file, which we receive directly after unpacking the original ZIP. It is loaded by the RunPE technique, substituting in memory the 2 above samples.”]

Source: https://blog.malwarebytes.com/threat-analysis/2015/10/unpacking-fraudulent-fax-dyreza-malware-from-spam/