Booking Form PIF[.]exe | Triage

Sharing

General

Target

Booking Form PIF.exe
Size

769KB
MD5

a66fdde12faf0f568b9830be2d2a5a01
SHA1

634c7ce02120b119833722559ebefae0bd365b08
SHA256

f1275d38c32f7ba6f9fd37c85c3bcc7437bfe85d30b8141220176e4b00717533
SHA512

57f244731be426e53569d881d6e90d6d912d5b561501bfafcd274f8b67ce5888e7344f8fc123b8ad3386059fec7d470430b7af9c3aee74dd113afedef3ef7b6b
SSDEEP

12288:eO72CyeJcn0ypAFlDFY5+PnS1FMrckuroNQrV5gYEF:NV+AFlDOUPnSPMrct5Vvc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Booking Form PIF.exe

Files

Booking Form PIF.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 605KB - Virtual size: 605KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ