signed documents and BOL[.][.]exe | Triage

Sharing

General

Target

signed documents and BOL..exe
Size

713KB
MD5

94429681dc767a26304ebe746df41b64
SHA1

9003339358b76abd29923035ede75336a22129fb
SHA256

1c9d7294c27649d4749a4a3e8c08cdd88fab4e7835cda473a6dde5aca7080a48
SHA512

2b1800de7471415f968665120914a80c0bcc46c5b527c63644e39fb15e4099f3f70e8ea36090a99e887efe447fa9e602531da11452dbe52e4ee2d2566fc93acd
SSDEEP

12288:HxN5JkuAgIWlMtlgtoyewj5WTXmnrdyVC+kAqSqGdyiZdne5Pvvjc0lTFmW+l:HxN5GuqsMtlg6yPlMXmnrdMuBGYiZdnr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
signed documents and BOL..exe

Files

signed documents and BOL..exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 702KB - Virtual size: 701KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ