QUOTATION[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

QUOTATION.zip
Size

610KB
MD5

588f5437b189059ff046306d21bd6ae0
SHA1

dab73097bff86dc46cb52978efdcb2e12192bebf
SHA256

f36adf5ca6eda3784d51fdcd306d914794278d69a1e181146a7cc31ab0881ec6
SHA512

dbdd534535815bcc7d45b6dd8928728e73c7bb9ed041641d39cd41d510ff40847b88f933be483cb6c2fbc6210e90be05210f5a6036cb5cb95a091856a06c69f5
SSDEEP

12288:DKTBGeMvZLeGPiOA0CsFq6tbk6V0nm8EztNmfxl7HOGmrsQ61etG:+T7YZ6GPikCsFq6t4FnmTDmfxlMQV3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/QUOTATION.exe

Files

QUOTATION.zip
.zip
QUOTATION.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Oblp.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 625KB - Virtual size: 625KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ