RFQ-3037380388[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RFQ-3037380388.rar
Size

608KB
MD5

5cd7961c0c17a8355b54a02a0200f9da
SHA1

600f6ab9e8d1301ac8391905a6e4e563b7293bb5
SHA256

eaf700b1b00383680d29b2d5c226c5dcdf76f6493b608b6de66435cadf8e3f55
SHA512

b0876fc2d942829791cb9e9439d70fa4a5dc3863835552a8b5c3575725561a573a61d9ebf9b1f8b60ef3ca7b9793207f03fe306d2006b75d4b7758f95062fe3d
SSDEEP

12288:4N0SkZcUDEUJ1nL0KHuf30GRboeYramDYQQz4sFqUL8Ti4FwIx:akHt907f3vbDTFqULYTt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PSUMtSYplIrFnts.exe

Files

RFQ-3037380388.rar
.rar
PSUMtSYplIrFnts.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 633KB - Virtual size: 632KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ