Quotation[.]zip | Triage

Sharing

General

Target

Quotation.zip
Size

421KB
MD5

e9915fd213d610ea6de7120c6440f88c
SHA1

0d6714153c9ff5ef906ef2339d5719e1c00e0256
SHA256

7ab6272027a5c082c715396006cf65efbc6f021d0011cdcf5c8954a902887637
SHA512

33e53bda0d90776fd9ec19ac30998e5e13a51218690925904096b8abe9915df0372a069eed7afab5935c1a0b1be884a6c6ab977f111ed248fee475206f0dee8b
SSDEEP

12288:Xk9nUPbzwyeXLwl7m2NmkYGWC7IaoXjyy9Ct:kUPwSm2ImxoXjyy9Ct

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Quotation.exe

Files

Quotation.zip
.zip
Quotation.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 666KB - Virtual size: 665KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ