13102023_1826_12102023_invoices[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

13102023_1826_12102023_invoices.rar
Size

666KB
MD5

6afae779c2a926a7b5b5338693e5a73e
SHA1

8f52ce492c6895c6eaf23ccd299ecc3d8b898895
SHA256

f00f870ffe8232737d8bbeea6eccbd1f3bd4c414d7fb7b1d0705619e3283ad32
SHA512

8e80802afd18624e25c219369b99b1e35d2512cd9c65983d52de5e1e1ab1554851d974b828cbac8ef5f1f7bbb3e62813cdde19deba2c2b73df16eba646a4ebd6
SSDEEP

12288:ECrXekaMbWMJ2E6Ib5wxc7tz0byNAWIDH70buQIOlsz4qPq8dtMNqmk6tX:E+8Q96IOc5UDHxG8PPdtqqqtX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/invoices.exe

Files

13102023_1826_12102023_invoices.rar
.rar

Password: infected
invoices.exe
.exe windows:4 windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 670KB - Virtual size: 670KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ