Quotation - 00645_1[.]bz[.]rar | Triage

Sharing

General

Target

Quotation - 00645_1.bz.rar
Size

547KB
MD5

9c03ad5c78cb4fd7336e380bd842f2aa
SHA1

bcd1cc7e41daed5bb3e29d2509caf674d228cee2
SHA256

276f9055909174b4cf05748f028a3f0cf9c33bc371200b1d0e9c366a1b92e003
SHA512

eea725a53d788db2e414207525350d4deadeec753f9e287597ea7816f906362b73db80cc57479eb36924f1c66df36fa19af5db747c0f0f35f42e2d143ebacfe7
SSDEEP

12288:/7+yoJkZW4WYmuHQ+Q2mfbIcA119V/L9bSrbSvc0n/4E4Dq:T+vJkZQuHQpMcA9VjwQ4EP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

unpack001/Quotation - 00645.exe

Files

Quotation - 00645_1.bz.rar
.rar
Quotation - 00645.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

otJq.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 809KB - Virtual size: 808KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ