Quotation[.]exe | Triage

Sharing

General

Target

Quotation.exe
Size

662KB
MD5

a53cd85a197fb62a0fb0fc18438f5d42
SHA1

b3b4d5698d8029e6839ea5b94a00057d98204570
SHA256

c906a3041425da5b92aca8c125d3d9295839b5edd1bb17b22fdd80f1f18a1293
SHA512

655723083d573ec4a2ab553943f373f0fe231daea799e33950a65c4342324af177b3201b9e805bbc90b4210c3f912836164c19a1a6934f905d24ccc2d6d12425
SSDEEP

12288:nVp0K8s6owWFpEYFYPnVB2eXekv6caLhCNPa5B:nVp0K8s6owWFpVUnWzkihC9aL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Quotation.exe

Files

Quotation.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 659KB - Virtual size: 659KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ