rebus[.]dll[.]zip | Triage

Resubmissions

19-02-2024 13:27

240219-qp2wvaea22 3

19-02-2024 13:23

240219-qm4yesde2t 3

Sharing

General

Target

rebus.dll.zip
Size

737KB
MD5

5952b4910e8a0bed472bde11bcf3cee2
SHA1

8bd5c3f7606aeb41d7327b27593a97458a1fe445
SHA256

35d311f52550b7b0b1b2f9d0b8d02c8dd703a3e745372e6d0abe985c0b89e056
SHA512

06845842de6c5abb20272c9c6d5b1ddc1cabe15e5788c040e5711ed834a08ef4d29b58490c0f098d666d5023b5d47df7ffe1db955ab78bf9cd76a5632c68db25
SSDEEP

12288:/d6vJ/LwWM6WZiEPL5M2zjfpB7sHnMAV7OUikTBDMoDIBKytLch7EZ1jqhXN2F2g:/d6RWwK97nhaZV7OUxSKdEZ0hXNEus

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Rebus.ni.dll_

Files

rebus.dll.zip
.zip

Password: infected
Rebus.ni.dll_
.dll windows:5 windows x64 arch:x64

Password: infected

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Rebus.ni.pdb
C:\projects\Rebus\Rebus\obj\Release\net45\Rebus.pdb

Sections

.data
Size: 711KB - Virtual size: 711KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ