at[.]zip | Triage

Sharing

General

Target

at.zip
Size

671KB
MD5

9445e433294c64684b092b5b16709d93
SHA1

566abd4ce059a19ef4e96ab5e3507144efed0717
SHA256

3eb38c1f2f8f94c4b6a608e7b1f9ea62aa0f417ba8443c45f7757f35cf1887b9
SHA512

912fa004f63124fe777deea0013fc72f5980f368bae922aab8497a906e95fcea969d44329fb3eaf14eb560fbe9159eb1e04610e63c0047f5c5d4175a120680b8
SSDEEP

12288:8rlAR1BGxo9EBBaV1utZz66W/43HrvVYFw062LJMEOqkdJwcl:8re3Eu+B8uagVSwD2LJRfw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/6d5bdcfa423fb3d5e48efd687f5ce8045693421e950a897c2e586fd44c3b0bb2

Files

at.zip
.zip

Password: infected
6d5bdcfa423fb3d5e48efd687f5ce8045693421e950a897c2e586fd44c3b0bb2
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mNxm.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 700KB - Virtual size: 699KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ