01052024_0904_30042024_RFQ_01052024[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01052024_0904_30042024_RFQ_01052024.rar
Size

599KB
MD5

a65b03880e4124c8e2f486d12f43acbc
SHA1

1b9f977fd7c107038412d55fca2c5c739ffba2f5
SHA256

b13e7570dfd982e4b1e8e75309677ceac3602958fdbe2da3567138869129d8f5
SHA512

6453efaceb197008105914addccd4f37bcaff26b3102066dc144e42c291809d7c9130077fa4551247b3505f0b031e32929ff591e32850aea87b51bb18c7e7696
SSDEEP

12288:PQjHRuHAdBeEYI56SEkocS0h4Yk4Crs0SjaBBhBMsQV:PYn+EYI56S/olKhgz/li

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/RFQ_01052024.exe

Files

01052024_0904_30042024_RFQ_01052024.rar
.rar

Password: infected
RFQ_01052024.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ