14022024_0335_13022024_Shipping Document[.]r01 | Triage

Sharing

General

Target

14022024_0335_13022024_Shipping Document.r01
Size

578KB
MD5

00cf99cbbe113c2dad15ace94bce5bed
SHA1

8d61625cc18f5ecdc06ac8f4b9ebbc4da1f5ed13
SHA256

f1ff0af2e70fe124dff55ac39bd4907001e6f3b7db9576c61ae9a33745b391e9
SHA512

cb46da30b8d95e9d13568c91e584d28f088100d19beedec77662807e5427d4b0b8d5a81fe6ca252f8540e6f2a07bc5947dd4270f184d86d93a78425f12b41cc9
SSDEEP

12288:rSLf4nPGCHEgPtkcMHWEa7Gb603DzoS4HMq4zGawfuu+zC:rwaGCH5alBxb6mDUHMlzGJr+u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/M5q4uWVi2hHJb5C.exe

Files

14022024_0335_13022024_Shipping Document.r01
.rar

Password: infected
M5q4uWVi2hHJb5C.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ZFCo.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 670KB - Virtual size: 669KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ