Windows_Office Activator By RXS[.]bin[.]zip | Triage

Sharing

General

Target

Windows_Office Activator By RXS.bin.zip
Size

775KB
MD5

c788ac054575d3709b0f592fa400bc7e
SHA1

9045270af8716d7724a62b0c5654e6930280a9e3
SHA256

369eac068fdcfd38726f9f5ef813f1ddee9ada72ccf1dde4bbc28c908e3cc6d2
SHA512

ba5ec4ef8137fa1b62bcca082a8110afaef9f04bdbe40e5d6c5cdb35b4adf5c2fd72b8716f94604474d8114b1bb1238b45fe665c9fb70ff79ee40e9f9eb1a88a
SSDEEP

24576:TGqsVdxf6by2mIw9jfT49fib6iReiCXIr8U:Idxb20l26bZlCXO5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Windows_Office Activator By RXS.bin

Files

Windows_Office Activator By RXS.bin.zip
.zip

Password: infected
Windows_Office Activator By RXS.bin
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 776KB - Virtual size: 776KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ