quotation#247833[.]pdf[.]exe | Triage

Sharing

General

Target

quotation#247833.pdf.exe
Size

612KB
MD5

52bbe58331758dd37f776189080a5ead
SHA1

2542cfdfee6da01c4657c13b3327ebf6f91d42da
SHA256

825a37255a61598eaa9eb15897dbc89f7e3637193c4e17775fbbc145ca523528
SHA512

a99a78ccc4ccc8fd2797d4f2f2c766c9043dd1dbbc7a588680d0472c43c44a78e31212c38f1753196cf0609e65b079b12656a59a934ae36ed4ff3e4f9312e5b8
SSDEEP

12288:S5+SDlnIqMoroxB4559YxaxO2b0NJk+mYRSn9//kcCR8gyn8M4Rxg:CzM7xy559YxaxT0NJkiRU+cCR8VD4fg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
quotation#247833.pdf.exe

Files

quotation#247833.pdf.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\Fallkyriya\obj\Release\Fallkyriya.pdb

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ