Bill amend[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Bill amend.rar
Size

497KB
MD5

bc9122c464b926d3c8988eaa3158c7c3
SHA1

25202f42a05827f38e6126ee872937d357a104c5
SHA256

7879f91cf0952523b9f3bb6e8cfebfc0481d9733a0664ead5d91b44626a9b5f5
SHA512

e47aa33421ca762f0f03b05963590f208045e2078b04a93e2f85d1c1450cb17fc12e8b1fdcc22b413f2d5f21c4949063b1e7db30c8f647a22c003a015c99a633
SSDEEP

12288:0uuercnnIoYVUZok2qRPegn1NXecqRqAfaVLSkEnlteLt:0uueryk0XtN1xdRSkE3It

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0IuqaJTsFmOw8k4.exe

Files

Bill amend.rar
.rar
0IuqaJTsFmOw8k4.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 560KB - Virtual size: 560KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ