dortcheck[.]zip | Triage

Sharing

General

Target

dortcheck.zip
Size

6.3MB
MD5

1e7bfd286773c686db5de3f4ea9535da
SHA1

d90886fe63a84793c7a494d4f589a5bc1e0a49e0
SHA256

f1a21f7e70cd5d8f084e8f63fabd1aea67e5d935eb9f3e397a6331c8f1735fbc
SHA512

c121204b963731c5b63e18aca76e19e1e0db58922cfa9359c0f779d06a3295e11c5119b9bfc11be584c865187f3c3488c6ca0ad99f847413c7b2f7a81be55e5e
SSDEEP

196608:NFUdL9K+MjuDB8PTGjK0cZkivbjfoa0mXYYP:MVqjPGjil/waJzP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/dortcheck.exe

Files

dortcheck.zip
.zip

Password: dort1.1
dortcheck.exe
.exe windows:0 windows x64 arch:x64

Password: dort1.1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

;::::; ;::::; :; ;:::::' :; ;:::::; ;. ,:::::' ; OOO\ ::::::; ; OOOOO\ ;:::::; ; OOOOOOOO ,;::::::; ;'

Sections

EinTim
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

EinTim
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE