SHIPPING DOCUMENTS[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SHIPPING DOCUMENTS.rar
Size

646KB
MD5

192de1d34556496bf09b74179fed149a
SHA1

42aa92b3c0478b7ddc481aba5bb4922a8399b8f3
SHA256

4af2b77bd6650c2923c14f99a094d035d43481bfda620c2e3b4e54f79c81921c
SHA512

7cf441d5f140ce81bc4277a60eedf3610515838b72b4af2b068405b34ae13c19b22693cc108fc755d8168028f8bc9357284e2fa5da6e9403ff78a88c8e6c8e4e
SSDEEP

12288:Oxx9Z11NzyoVUq0HeSINYlf6oKRluNHWCFxJ8SRyvQ+3aaRj:OHP11ND/0HJINYN6ow0OSRy7H9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Urbxjwvo.exe

Files

SHIPPING DOCUMENTS.rar
.rar
SHIPPING DOCUMENTS.img
.iso
Urbxjwvo.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 802KB - Virtual size: 802KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ