Behavioral task
behavioral1
Sample
QUOTATION_NOVQTRFA00541·PDF.scr
Resource
win7-20231201-en
General
-
Target
0d5d150307091f4f2b0040362ceacea25b78abfa2d971772d0279d7506ad8978
-
Size
478KB
-
MD5
9a9993bb71ce105b4dbade9aef4b107c
-
SHA1
b39fc991404d4a63fa7aa60ed5932760a9f40864
-
SHA256
0d5d150307091f4f2b0040362ceacea25b78abfa2d971772d0279d7506ad8978
-
SHA512
e62bb488fb4efb9e8b739785a0451e8d210c4f242b917452f469dc9f7f85a0d34f781a0aac8918e85802b4aa6323fafa551cd29cd87fbb54ddc7b597a2b03417
-
SSDEEP
12288:woapjb1nuPldWSUys+nug5hkcno8jr/UakT8Uv+QxJqJ9sR71:7wjJ8ldWSFjtbjT9UGQxJqQR71
Malware Config
Signatures
-
Detect PureLogs payload 1 IoCs
resource yara_rule static1/unpack001/QUOTATION_NOVQTRFA00541·PDF.scr family_purelogs -
Purelogs family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/QUOTATION_NOVQTRFA00541·PDF.scr
Files
-
0d5d150307091f4f2b0040362ceacea25b78abfa2d971772d0279d7506ad8978.rar
-
QUOTATION_NOVQTRFA00541·PDF.scr.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 646KB - Virtual size: 646KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 327KB - Virtual size: 326KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ