nQuotation[.]img | Triage

Sharing

Copy URL Twitter E-mail

General

Target

nQuotation.img
Size

1.6MB
MD5

579e7f48b616f70291eef2dd3d4f9f0d
SHA1

528d6808dcbdcab7db82c451daec21909b59abe4
SHA256

fc1320764b36b24dacdd145eed82408f63888107bcd1bcb4f4c1e41760f54590
SHA512

1b3211fbac304a806c8eb2e82c1e39d5a3147f079bec9d87e672c7d5ab4977c7b189ec7494b1c120b93b487ae1a164edf78fe002220e61a6bfe0e4bca7bf5357
SSDEEP

24576:8mKOc0W69AThgTbppD9DjKe390s+a7aerTbU34:8mIXThgfp790la7vrXp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/QUOTATIO.PIF

Files

nQuotation.img
.iso
QUOTATIO.PDF
.pdf
QUOTATIO.PIF
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 905KB - Virtual size: 905KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ