Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
QUOTATION.exe
Resource
win10v2004-20230220-en
General
-
Target
17c7dc612ab439c50db10d2b9c6be386.bin
-
Size
537KB
-
MD5
6d212c6f501ae105c09cac17d6999dbc
-
SHA1
7ed3db13b5d3193c1d953f1e850fa841e44ca7e2
-
SHA256
530ebc03d8fbb2a1c0f839fcac4054aa484f8071c04c2be3dbbc43a660f227ed
-
SHA512
c3fe9e32ec937d281ccff6b49ec2b5a471b048cfbaae37c87b1bf60293633494f87ac4605bf4b555143b28bd146d4b4942c4c2da8772a54d597f0691c1d7a3a8
-
SSDEEP
12288:0OT5mLSzOsG53hg6q0z/RGlRJNysGotvm93XKfWS97RCyPY:PZG5DJG/JIsGFNZH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/QUOTATION.exe
Files
-
17c7dc612ab439c50db10d2b9c6be386.bin.zip
Password: infected
-
7c097aac7fea970ff441027a817d7a03b4556262747bc0567f9c96694bf2532b.img.iso
Password: infected
-
QUOTATION.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 602KB - Virtual size: 602KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ