RFQ_V40795[.]pdf[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
RFQ_V40795.pdf.exe
Size 520KB
Sample201109-az6fxc16ee
SHA256 a1438fd2ecd8a17372fde0f4920d510bce698eeb2eec5d29d67fbc15523d2e1d
MD5 63a2ec09db4568a893a1e95c35b64c12
SHA1 e5004a71b47bc3918fac346a11ea618a15b02cc8
SHA512 5f1235058cfccc993c832db187c8452e6974084ebc1c92673e0d1845fb78e0fcf367d0b59a062309d8c294321eb9d39aa5a1c59aec7b2d093f13ca16191a5a62
MD5 SHA1 SHA512

Score

9^/10

Malware Config

Signatures

ServiceHost packer 1 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
sample	servicehost

File Explorer

RFQ_V40795.pdf.exe

.exe 520KB

RFQ_V40795.pdf.exe

SHA256 a1438fd2ecd8a17372fde0f4920d510bce698eeb2eec5d29d67fbc15523d2e1d
MD5 63a2ec09db4568a893a1e95c35b64c12
SHA1 e5004a71b47bc3918fac346a11ea618a15b02cc8
SHA512 5f1235058cfccc993c832db187c8452e6974084ebc1c92673e0d1845fb78e0fcf367d0b59a062309d8c294321eb9d39aa5a1c59aec7b2d093f13ca16191a5a62
MD5 SHA1 SHA512

windows x86

ServiceHost packer

Detects ServiceHost packer used for .NET malware