RFQ Q0392_2022[.]gz[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

RFQ Q0392_2022.gz.zip
Size

219KB
MD5

cd9746d6f427129c8f7a48e4a980a921
SHA1

7ac9cfcdd8f6d35f598b7302e61214f3aeb9b80a
SHA256

336d5d1752f15c393f5ea751bd6bd95bd0c949739f2c7543a69c5e7c2f4a3d0b
SHA512

2c41568b2f7411d640b5c23133174c9bbc4cd8022488d1b86179cc07003974b71012efc504a05084527a526ba1b1ba8cbf54abc6f6dc7abadf13a319709bc09c
SSDEEP

6144:bsSxO082Ot0N5dZ5rfCLYgbnFsTCrP4t6LyqvD9y2z:rOyPN5dZ5+LlFsTCe6Lyq7bz

Score

N/A

Malware Config

Signatures

Files

RFQ Q0392_2022.gz.zip
.zip

Password: infected
RFQ Q0392_2022.gz
.gz
RFQ Q0392_2022.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:02:9b:13:02:82:8f:f3:90:4e:d2:00:00:00:00:02:9b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/01/2022, 19:36

Not After

26/01/2023, 19:36

Subject

CN=Skype Software Sarl,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a0:57:be:62:3e:84:04:42:67:60:99:2d:89:56:05:e2:78:b6:47:d9:cc:8a:f1:a5:ba:91:d2:48:b6:15:5e:0f
Signer

Actual PE Digest

a0:57:be:62:3e:84:04:42:67:60:99:2d:89:56:05:e2:78:b6:47:d9:cc:8a:f1:a5:ba:91:d2:48:b6:15:5e:0f

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Skype Software Sarl,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

09/09/2022, 12:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 233KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:02:9b:13:02:82:8f:f3:90:4e:d2:00:00:00:00:02:9bCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

a0:57:be:62:3e:84:04:42:67:60:99:2d:89:56:05:e2:78:b6:47:d9:cc:8a:f1:a5:ba:91:d2:48:b6:15:5e:0fSigner

Signature Validations

Verification

09/09/2022, 12:35 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 233KB - Virtual size: 233KB

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 512B - Virtual size: 12B

33:00:00:02:9b:13:02:82:8f:f3:90:4e:d2:00:00:00:00:02:9b
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

a0:57:be:62:3e:84:04:42:67:60:99:2d:89:56:05:e2:78:b6:47:d9:cc:8a:f1:a5:ba:91:d2:48:b6:15:5e:0f
Signer

09/09/2022, 12:35
Valid: false

.text
Size: 233KB - Virtual size: 233KB

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 512B - Virtual size: 12B