Order Confirmations[.]exe | Triage

Sharing

General

Target

Order Confirmations.exe
Size

647KB
MD5

bfd203d85d6aeb94071e2897b02739aa
SHA1

6d811b83bdaa7c1b5e6dba4aab03c5bc35c4e57a
SHA256

5dda5302383b5a1677891f2bcb1da4876634f20c6cbecd2ec9a5e63a24fd5cdd
SHA512

ea29e969cd86b3f5e439d45b21414f3b27aaea9474a7aa7428c5352717e44318c10542079cb31261cafed4375e68d2ff267a803509c9a7e9a88935153e03c1ec
SSDEEP

12288:WUHs33hhOvt5Q6BSdN9/yaqv2omAvAbOET4h2cWjoIR:Pq/Ovtcur+ojv8OEirA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Order Confirmations.exe

Files

Order Confirmations.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

PpLN.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 644KB - Virtual size: 644KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ