Static task
static1
Behavioral task
behavioral1
Sample
Quotation 1259191_PDF.exe
Resource
win7-20231215-en
General
-
Target
1c8b1a57e1514e65964976df5b7737eb.bin
-
Size
634KB
-
MD5
386925fa9f02bd8804226ffaa6c4b59e
-
SHA1
b391becafe2e26d6a0d8e666945b942d26328106
-
SHA256
9e69a59306480d9ca288c468e94dc4da5efde94c60f8fc6498ff311fa11b19fe
-
SHA512
1fa958ab91978bef44bb98aac2a2640107aeb1d8513a252f0e1340604f0cf6c1acef16b5c344b5453837a35178b88bad043138f6850003c14dcfd879e2cfc86a
-
SSDEEP
12288:n9Qnis+YsT1GiT8xW7p8gca0QxI4Dv1zfHuFAsrB5JVabUl:n9QDYt8A0QLvZPuFA6BD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Quotation 1259191_PDF.exe
Files
-
1c8b1a57e1514e65964976df5b7737eb.bin.zip
Password: infected
-
280ad8d5acd545731fcdbf43e3f633986a13df774679f0292145bbd4ecba030c.img.iso
Password: infected
-
Quotation 1259191_PDF.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 646KB - Virtual size: 645KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ