RZS email ellenorzes_v2[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RZS email ellenorzes_v2.exe
Size

397KB
MD5

c6310935114d3f976b2eee219cb7eed8
SHA1

c011b7a3b7a702abb2fa571efe1f395bb287124e
SHA256

592335a4c69dbabb64da6bb6c1cb666c96a83f732552966ead94e6dabbe866be
SHA512

0c3624d92361ad8b35edbd65c2e7c2ab38d569b5d8f4ea8c89c9c9eb89cc4b8b18989c0ae5e931a8529d1685f6e4be44771a0f762bec92cff6709f38fbabcec3
SSDEEP

12288:k/xVQRRvUpiB6QexsCenZnjSvHpplIUj:hRZB6/sCqZSvHTD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RZS email ellenorzes_v2.exe

Files

RZS email ellenorzes_v2.exe
.exe windows:6 windows x86 arch:x86

a267797a454c3e511adf7ab26e650b48

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

wsock32

htons

winmm

joyGetPosEx

version

VerQueryValueW

comctl32

ImageList_Create

psapi

GetProcessImageFileNameW

wininet

InternetOpenW

shlwapi

StrCmpLogicalW

uxtheme

IsAppThemed

dwmapi

DwmGetWindowAttribute

user32

GetDC

gdi32

BitBlt

advapi32

RegCloseKey

shell32

DragFinish

ole32

CoGetObject

oleaut32

SafeArrayUnaccessData

Sections

.MPRESS1
Size: 361KB - Virtual size: 976KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE