shipping doc[.]exe | Triage

Sharing

General

Target

shipping doc.exe
Size

661KB
MD5

ff46c0bcefe3460241f6291f551c461a
SHA1

cde992ddcc16e2c42d39c89c48af840e354a0f29
SHA256

47361c18c953725b9469ef9a229e109e981bdd1b2673f7ad582d98d1447110c3
SHA512

f518d63316294e291449206ff09897decef7275d235e57bc5c6fd98113f9458bd6c1c8807a12b015bf6238fa0b663cce18af80566916172554a28e62807a3525
SSDEEP

12288:qRB778QCdqBOxWqLOZhxqAA8qmZ7WKGYBI0pdY:GB8dqq8qmZrg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

shipping doc.exe

Files

shipping doc.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 656KB - Virtual size: 655KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ