01689299[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01689299.bin
Size

501KB
MD5

88ce3faf9825e86d07a4364b38fdab9c
SHA1

b1535297f890c5a6c7b469e5dbcad298a63d6897
SHA256

2ea66396d154eaa7071baf01d8e9a1ae2c3ae4036996871ef4eb389d4a33d1d2
SHA512

00f476983c9887ef7113f4b3dab5c528a7fea638aa9f07690feecf8715fbd3e7111e282a37dd2e4fcb66f01343bc5321c3929fcdf62e417b46479ff98f5d0840
SSDEEP

12288:N1ktSLf+Po3f2omJNotDslChi71vIe95vviYq94Ojq:NGUQoeoqu1s3VXlK94OG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/PRE ALERT DOCUMENTS.exe

Files

01689299.bin
.zip

Password: infected
e91da65f2e92a516fa93fd1d80c4d141efad8714f830ec76cd1b11c65d97f95c.rar
.rar
PRE ALERT DOCUMENTS.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 962KB - Virtual size: 961KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ