ISF (10+2) Form 格福-3019 NASHVILLE[.]xls[.]scr[.]exe | Triage

Sharing

General

Target

ISF (10+2) Form 格福-3019 NASHVILLE.xls.scr.exe
Size

943KB
MD5

40a1bbdd302c9737d10df6648e6db7dc
SHA1

5f9d1d4d3aea4a82542b54a84d0fa7822bd24d2c
SHA256

6f4fbb8059780db756519fae97b7f00148f1df2b96ddaf9752d9409d45c1a37e
SHA512

98fa809cb8b7fe598f07bc61658f39379cddbfbb44ebe4e1ae8882a9ead4406820585d51a0ce836d7f2e40e532acfde61c7ba7868175871f771503a813bd0f8b
SSDEEP

12288:XVTGAlfBpSGC9Ed/Ff6qVn60dP185uk+mzA0pRELuvg8IQjzek:XVT7rhCqd/N6qVlyug8IEaY81Pek

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ISF (10+2) Form 格福-3019 NASHVILLE.xls.scr.exe

Files

ISF (10+2) Form 格福-3019 NASHVILLE.xls.scr.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 941KB - Virtual size: 940KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ