Quotation[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Quotation.zip
Size

380KB
MD5

731f0009aaff654f6c1b309d03cf0637
SHA1

0be5447bb2604ac5d7b154d08acfd0a723f5568b
SHA256

6a102e7a52dcba489660634457471aae2830e0374de69dafb5980ba519c4ae00
SHA512

a82c63dd4d0ad5b892a0e79d6985955ba27fb7ccb0353eb1e32ce9351b0b46d079da841f08d2528b9f5ae6447cab894a01a6919774decdc128e97977c8974a13
SSDEEP

6144:o2yFpCEPfRJL39fbAn2aj68sVWu75JC3/2CrLg/VUkSJNmIXKqAHWEaSb4C8+4tz:o2yFpCEHb9fbQNjNu7zRhO/mI6qAHdk/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Quotation.exe

Files

Quotation.zip
.zip
Quotation.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 608KB - Virtual size: 607KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ