QUOTATION_SEPT9FIBA00541[.]z | Triage

Sharing

General

Target

QUOTATION_SEPT9FIBA00541.z
Size

859KB
MD5

bc586373081e689b4ce239a567537aa6
SHA1

779a6b4d961d1ef9000bc6209e1d99c11d82c734
SHA256

5b50e64f13012e74456b891c01871c12989c9a67a906fd7d8d3550ddf6c1f23e
SHA512

437adaa60879cd2f76468103f5f68b99c19ad28c66470b8d37c20fb0942cdead87b7f6d7b8ba977769e6fe4af3fbb9446cb95823330ed64b2797f4e806bc6c1a
SSDEEP

12288:qQ5etS0QkUbs1vjxiWOhojEypAaGkCiHgNj6trOcPK5dRH8HLS0M3c1f3x:qQ5eI0Qk8sRGojpPCCYj0BPK5EwMdB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/QUOTATION_SEPT9FIBA00541·PDF.scr

Files

QUOTATION_SEPT9FIBA00541.z
.rar
QUOTATION_SEPT9FIBA00541·PDF.scr
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 327KB - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ