Quotation[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Quotation.exe
Size

240KB
MD5

0d7c259c157208ed087de127e9759687
SHA1

d66ed5ad63438425dd7029a109983125cb9db318
SHA256

8259eff22466f7ef35455edda25db31de7334666d4e7bce013c898a3777b4861
SHA512

1e73abe780e5cc2c33989302ce482345442e530f33c662fe30fb3dd35f4983d7d84538cba1aff6a4d933cbae3a834eae47b809e69084aacdbb0fce2fef2c6066
SSDEEP

3072:BhdhA9UeInbpphsvrlfKuEZCRLDQRULaGpwYuzKZRdp19a/XuJeDP1PBb1oW1:cdE8sCRLDKULa7zKbdn/q+W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Quotation.exe

Files

Quotation.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ