microsoft[.]photos (infected) [.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

microsoft.photos (infected) .rar
Size

18KB
MD5

45714dd0da26cd2aab13b897a79554b1
SHA1

ed2126e22d94c49c7a73a3c084c1e3f40766768d
SHA256

2958b59cf3afef06edbc2bfbf6c7158d3c9f71a669e4206c96c234e2cf9308b3
SHA512

cc9d358578a8172141ba21cd14a5d7ef3b595326645194d35fe6b05c7d8513576b722aa6c00f0ea5d6a14baf3fa68d78a96890584916574be634573e2bab6c2a
SSDEEP

384:c2SvVXqFcbiLC3nThERwiwoyFN07z0izv8PCUgpT+Cat+MLKx:aXqFqiLC3ELwHFNSTzv68T+6MLe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/microsoft.photos.exe

Files

microsoft.photos (infected) .rar
.rar .zip polyglot

Password: infected
microsoft.photos.exe
.zip

Password: infected
microsoft.photos.exe
.exe windows:6 windows x64 arch:x64

Password: infected

051a7e15badaffdadd027c09c1bde1e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

microsoft.photos

RHBinder__ShimExeMain

Sections

.rdata
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 464KB - Virtual size: 463KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ