PROF[.]600398[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

PROF.600398.zip
Size

574KB
MD5

7f69a51e045f08f8664a132dfa9b08ba
SHA1

a8681f435e6ffa8b299ea9394fe2adfdeb5ad066
SHA256

bb003aa2b85192e9ff013ce285782d0bf73da5a1437e8b658aef6a8e675d3c7c
SHA512

8bdef61dc9ef1320ea71a2a45c23607f41edc1a61bf9d8673a55b3751cd8a56e05aa9a4d4b2a9aee1171b039fa38367a6ca0dadabfc02080b74c83e8a5d7974b
SSDEEP

6144:NqFtBT8lcnRULZzlSh1PBcNqk8m+y3RtUFjkCBJiGvp4Ge5OaQoLz6bj8R6B3Y50:sFj4sUhlGVBDmQXjple5Sbj8oBc0uO4O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PROF.600398.exe

Files

PROF.600398.zip
.zip
PROF.600398.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 634KB - Virtual size: 634KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ