QUOTATION[.]xz

Sharing

Copy URL

Twitter E-mail

General

Target

QUOTATION.xz
Size

228KB
MD5

1d1e657c36430e5a41f965023658c2b7
SHA1

70ee6036b2becc72320ad705a38bd6431b87a311
SHA256

f9dd63c8cc9e80bfe6e69bd1ef762a5bb93eecb7f8ed5c09a568dd2f7ca1b767
SHA512

eb7a647a567713fe269cab718f88fab8cc14c2312a271d9c3d7f8b9fa9a48f1098672156f035d1ebf62927ff3fcef3d2d571cf313a617ce430885bffb6dd7945
SSDEEP

3072:NIRw4qURy4o6dVsJM4NCkY5e3yEyCy9npd+JgxrnI+ZjLd4iW28XOZkbFUYAdweF:+RwMmfCkY5Sy5Fp46ZLovXyYQ+TWcAz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/QUOTATION.exe

Files

QUOTATION.xz
.rar
QUOTATION.exe
.exe windows x86

eb55ec890528ca04e6435e92462c7b09

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleWindow
lstrcmpiA
InterlockedIncrement
SetFilePointerEx
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
WideCharToMultiByte
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
HeapReAlloc
HeapSize
LCMapStringW
CompareStringW
FreeLibrary
GetModuleHandleW
GetProcAddress
VirtualProtectEx
LoadResource
IsDBCSLeadByte
Sleep
MultiByteToWideChar
GetModuleHandleA
GetCurrentThreadId
FindResourceA
LeaveCriticalSection
EncodePointer
LoadLibraryExA
InterlockedDecrement
GetCurrentProcess
VirtualAlloc
EnterCriticalSection
SetLastError
SizeofResource
GetModuleFileNameA
DeleteCriticalSection
DecodePointer
RaiseException
GetLastError
GetCPInfo
InitializeCriticalSectionAndSpinCount
GetACP
WriteFile
GetStdHandle
WriteConsoleW
GetModuleHandleExW
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
CloseHandle
GetFileType
GetDriveTypeW
CreateFileW
VirtualQuery
VirtualProtect
GetSystemInfo
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
OutputDebugStringW
HeapAlloc
HeapFree
GetProcessHeap
InitializeSListHead
IsProcessorFeaturePresent

user32

CharNextA
ShowWindow
MessageBoxA

advapi32

RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegEnumKeyExA

shell32

SHGetFolderPathA

ole32

CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc

oleaut32

VarUI4FromStr

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb55ec890528ca04e6435e92462c7b09

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 90KB - Virtual size: 90KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 2.0MB - Virtual size: 2.0MB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 90KB - Virtual size: 90KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 2.0MB - Virtual size: 2.0MB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 5KB - Virtual size: 5KB