Quotation[.]pdf[.]z | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Quotation.pdf.z
Size

618KB
MD5

e53e3a95646d8e2654bebdee6b687b9e
SHA1

fde5156a8f7ff273bd1353a1b9f4e21c2418de87
SHA256

78f522862bc39091d29d9091f6efc6fc4d7d6797c76faae6a65c26522f191991
SHA512

dda414046a7fb6e3cb3b758f113c9324c3708ec22b6db155b47ddb3ecbf46db2a316f06a2cd638481c7901742f1458aaf0e06df29f3b428e1146fe8bfcda5729
SSDEEP

12288:pipfKAhCNolQUrYkKQvTJad/Tfb5l8mUSi4va0tsaJpeTkMg8nG3rTw6e2zz:pipf9/YWTJofNl8mPi4vxtt7eTC13Jzz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Quotation.pdf.exe

Files

Quotation.pdf.z
.rar
Quotation.pdf.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

FeFH.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 692KB - Virtual size: 691KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ