RFQ,xlsx[.]zip | Triage™

General

Target
RFQ,xlsx.zip
Size 638KB
Sample231026-jzeezaee66
SHA256 a9b613bd939be1d785b4b528ead8d92df9354c4dfa092022c3bca4094d76f5ba
MD5 45a907732b4519deb6936f28abf5f094
SHA1 4592d91cccc384562c30f9cc982338ca2db0994b
SHA512 30dedc71c68fdb642ee752f8756015af8fa6eb2f1b12f2136848cb41bd0f8e5637041f2a067b2f8fa6569719880c64b11ca364060e90151028415df09055ea5a
SSDEEP 12288:KZ4Ck3Scv6Gqn3WyukqrBRm2oVkKpnJyHFtCPv6vwTngivjP/Q/:k4KjV3gprB8HRuCnqw1Lo
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/RFQ,xlsx.exe

File Explorer

RFQ,xlsx.zip

.zip 638KB
RFQ,xlsx.exe

.exe 717KB

RFQ,xlsx.zip

SHA256 a9b613bd939be1d785b4b528ead8d92df9354c4dfa092022c3bca4094d76f5ba
MD5 45a907732b4519deb6936f28abf5f094
SHA1 4592d91cccc384562c30f9cc982338ca2db0994b
SHA512 30dedc71c68fdb642ee752f8756015af8fa6eb2f1b12f2136848cb41bd0f8e5637041f2a067b2f8fa6569719880c64b11ca364060e90151028415df09055ea5a
SSDEEP 12288:KZ4Ck3Scv6Gqn3WyukqrBRm2oVkKpnJyHFtCPv6vwTngivjP/Q/:k4KjV3gprB8HRuCnqw1Lo
MD5 SHA1 SHA512 SSDEEP

RFQ,xlsx.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ca31477651e5f566affdc7426300bbdfecef8ca2c38803fce93337ec84b11037
MD5 1a79ec4a26af056ff88aa5625b5d0268
SHA1 54c17124f43caec674e0af7607a40f058c3d6864
SHA512 d31d3ba61e3e9d32074fee6e2030b3a37c7cd118b08e236110daf8cda8d6243e4059a9e7be006afc055ed20c62eabeaa95e8e30fbb8198e7cb736b131d66f4b5
SSDEEP 12288:HMQHMjgR/mZRM+Bfqp3WyuKqr7u0jTCud5ecyA7o1PCvv6vwTH0CK0wW:CgkZR5wlKrr7Fm36o1PCHqwxD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

739890

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

RFQ,xlsx.zip

RFQ,xlsx.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

RFQ,xlsx.zip

RFQ,xlsx.exe

mscoree

dotnet