mkpub_BL for 4704854 4665930[.]ARJ | Triage

Sharing

General

Target

mkpub_BL for 4704854 4665930.ARJ
Size

265KB
MD5

80d739b6842652b2669536704e00ee9f
SHA1

591a26a3b224e3fc72927dbeb473a8e5671b8282
SHA256

e47b1b9175956f51e800bcf304927ab4c613387150ed22b5f4085223b4f6442f
SHA512

cb516127ba0999d23fa134a98441c8ca6c7070cf8c44e8eb5de87b89bcfc29df09df5a19e09d2956a53ad88e61f1b40fe27a038e560af5853ce04d47759818c6
SSDEEP

6144:O/p3vzVkkJncasZ3fdiXvjU9o/+DaukDKLx6V+xDXrvIomWFid:O/ZyklcasZ3fK+DJrLGIDXrbnI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/BL for 4704854 4665930.exe

Files

mkpub_BL for 4704854 4665930.ARJ
.rar

Password: infected
BL for 4704854 4665930.exe
.exe windows:4 windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 766KB - Virtual size: 765KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ