loading advice[.]rar | Triage

Sharing

General

Target

loading advice.rar
Size

658KB
MD5

862c6fb3d4d5f674de404fed6d82fab4
SHA1

8000c9aaf7e3a1c491ec2c9355099428f70392ad
SHA256

8709fc8beb7accd18bbdd309cda7b52af0681f10f8366c895ddb2ffc9683b956
SHA512

862137110b4df2cd292d58a3b4b84a1e2f8b578b551eea52ef4d84af3bdb50748668eaa7aaaf1c8b297abff5c4f83682d878781bf0e3a363e17f73b9e7d6a25d
SSDEEP

12288:n0+SVL1DlJUwUycbYBVjjRVxskMr0zI8acFR4ViJIPw101xCAmSZzul1:n+vCwpBTczNEbLuw1sCAeL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

unpack001/loading advice.exe

Files

loading advice.rar
.rar
loading advice.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 773KB - Virtual size: 772KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ