rooming list[.]7z | Triage

Sharing

Copy URL Twitter E-mail

General

Target

rooming list.7z
Size

601KB
MD5

fbdacca9e7260eb378007b3e31f8bb80
SHA1

e678b179d1bd67bde72a80c2703a1a84994af3bc
SHA256

9f78a782c9f0c2152ff85238aaffed86e82f76b4c1994609f5d617132d7deee6
SHA512

efd706f8901103747d2e6a5b3be338774c4deb90847e84021e27c00b9d434686e89b6df16651e02717514eddbb697b8f1c5c00f3718069639effb947005855da
SSDEEP

12288:A4CazJ3nx1umXKfgs7udPHoQHCEAnon9RIREEHCVCalK:A4hJXx1NKflgHoCCEqo9F3vK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/rooming list.exe

Files

rooming list.7z
.rar
rooming list.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

SFbE.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 610KB - Virtual size: 609KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ