6d37f9b3dcc6c0ae8da12d65e37ef3b1[.]bin

General

Target

6d37f9b3dcc6c0ae8da12d65e37ef3b1.bin
Size

859KB
MD5

a1063348e5d3eab469166907d57bf51e
SHA1

a316efdc68159cde7e968567efeed8c896fbe3d1
SHA256

6008f20f3c7af36172d3675bc509697226453bb87531e30cf96b11c6ab58d2a3
SHA512

25a30c0b378a68e7029716903e3cc34976dc443eb7927e4b103322da76d9f56ad2210eba34a5a54689b9e9b6903d65fe1704ba43647691a637ebf6455a68f53c
SSDEEP

24576:qXIQzYdAn5ODzzxWU5D5wyzERyxbQEiR9cuLBSQEIQ:laYYODfxHdz8y1iLcugQy

Score

3^/10

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack002/NEW ORDER RFQ ICPO TECNOMAT-JEAL-EN590-200KMT-RTDM+TSA.bat

6d37f9b3dcc6c0ae8da12d65e37ef3b1.bin
.zip

Password: infected
c44885d6ad1fd9ec685e1f9ab6017d9f80ba9d1762d02d79c924e49b488d23d5.r01
.rar

Password: infected
NEW ORDER RFQ ICPO TECNOMAT-JEAL-EN590-200KMT-RTDM+TSA.bat
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

VXDr.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 892KB - Virtual size: 892KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ