nORDEN 679564[.]IMG | Triage

Sharing

General

Target

nORDEN 679564.IMG
Size

1.2MB
MD5

59f6e75fac3d2e506c29fa4e47df23a1
SHA1

ef1b51e5541afc7eef2d4b00308d379949082969
SHA256

2618d6050cf95f5f7ed43208a77d88cb742c2afc4f45ebfc6048854357721798
SHA512

8c9563d05fb5302e4a7be9018293fc16798f806fc52b0c6ec4e8a95089bda3a9bebdb55abb04054b227604a6a6b71d19358bb9403e805ca77c44fb0a2589e735
SSDEEP

12288:WKqOBI/Xp/5A7MdBGqFnb3ZARqHa6TLHrh8Jfb4b2kv4:WKXIvlBf93kKaQ2JTK14

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ORDEN_67.EXE

Files

nORDEN 679564.IMG
.iso
ORDEN_67.EXE
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 675KB - Virtual size: 674KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ