Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
QUOTATION.exe
Resource
win10v2004-20230220-en
General
-
Target
d5a3e7a9a183bab58601ac56db594680.bin
-
Size
479KB
-
MD5
c43cd44fb0aba3d751672391815d609e
-
SHA1
c41c97b4c8b04954bf27917ef1feb2b213585b99
-
SHA256
8040794eae8d20580027d429589d4a70cf0952d57b087a472203b4c333e241cc
-
SHA512
26b5176caf01de148c81e255cd6ea14c8596c805ce14c79fba3ce231bc26956a9cefde350bc0ea1ce24a7ee1ad8b3d6cd08b24905cacf83f547b7c7ea2f18681
-
SSDEEP
12288:rsm65dvzbZsYS/TtHYkOCivTbHbKSuy9VQZUOWtssmlQYrBVQBUq:J65wT0Cgb7KSu9UTtsszYr7nq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/QUOTATION.exe
Files
-
d5a3e7a9a183bab58601ac56db594680.bin.zip
Password: infected
-
75fa9a5db7782cc413bc804d188f2cb084f5baaffedb9d3ea26948da21fbaa92.gz.rar
Password: infected
-
QUOTATION.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 707KB - Virtual size: 707KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ