Advised EFT Payment 0902746579 Note[.]rar[.]pellet | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Advised EFT Payment 0902746579 Note.rar.pellet
Size

30KB
MD5

821f168603857aa0f2aa7bce2b1678b0
SHA1

8751d591787f70279af89af5e2cc72a43b44564e
SHA256

b1444ae1dfdbfdd546dc372576cc32c5f6dd2a0f4a0f6e34f4c3a5a4a83795fc
SHA512

5e61edfaf4d57f68a311cc564d08fd107a6ebb5ec6b18bb497444a9fef5d7141c441002f6132ccee61ff44fe02d6fbc1c673009ea2fe577992a1a354f599a7d9
SSDEEP

768:ly+SdzhyGU/R2u6sMDREjO119bqXr6Um/:kryGeRV6MKxbqdm/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Advised EFT Payment 0902746579 Note.exe

Files

Advised EFT Payment 0902746579 Note.rar.pellet
.rar
Advised EFT Payment 0902746579 Note.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\Jabret\obj\Debug\Jabret.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ