17052024_0121_16052024_Booking number_4AD69200IN4[.]rar | Triage

Sharing

General

Target

17052024_0121_16052024_Booking number_4AD69200IN4.rar
Size

521KB
MD5

3a20a3f9fdcf78430d67bbc98c623dab
SHA1

e862c03c00f6722cfc18402cfc829cebdb0c1142
SHA256

cb652ef8acca969d32fa21948468cf2c6cb871e8076671ef22318781fee2176d
SHA512

3b9e15748b87a9fc995fb67cbde2e90b2259bf45f44edc924d952404cef210bfdeb6a4dd26d1e3dd8885da9a674e42ef3e98c527c73e31d30d1c339d15680b0c
SSDEEP

12288:iykrS1bg5mEFNezLgADaZDlB3Bp+t2mAUzOtuXZvukax7:iR34EiLgdP3BpLmj7XZvnaB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/U9MIn5ATFJUc3Ki.exe

Files

17052024_0121_16052024_Booking number_4AD69200IN4.rar
.rar

Password: infected
U9MIn5ATFJUc3Ki.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 550KB - Virtual size: 549KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ