0-24[.]eml | Triage

Sharing

General

Target

0-24.eml
Size

3.7MB
MD5

b8f7a665cc7c3e63f5bd4c0ff7a3861f
SHA1

86102a5dbea665d74400b3e9d96ecc2711e65c40
SHA256

82f59f962e4c529762a6a9480ed25a4c90ec3848b947344e9c8fc79f2852791d
SHA512

c480013025921fd89a98b1501231466695590a71a9c243f79d2c7e5b6340f773354b07f3a55e0b35a026b6a497f26955c1b0c3c48dcb05bca9f1e90a7d4aef72
SSDEEP

49152:JXJVEkhsvI5T5R/mHE0UTwIsywtcrZ361RSjekakRCzp7XG8hA:j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/QUOTATION_MAYQTRA031244PDF.scr

Files

0-24.eml
.eml
- http://www.sinergotrento.com/
ORDINE FORNITORE.z
.lzh
QUOTATION_MAYQTRA031244PDF.scr
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
email-html-1.txt
.html