06062024_1708_06062024_PO 576060624[.]xlsx[.]7z | Triage

Sharing

Copy URL Twitter E-mail

General

Target

06062024_1708_06062024_PO 576060624.xlsx.7z
Size

685KB
MD5

fb969c585cd989aa17d3f242874812aa
SHA1

82e5a56231b06b7fc77ca88ab37b80ad07b5a964
SHA256

f6693c52ae21578fd7b3a83acaee1ba3bd3f370e2220f12c6bb7910b6d07bd95
SHA512

4102ff51acdeda9e63dbef2681b39aa10a06cc356b468ae6c18cd777724179431199c639fb9a0f998c2911f04842bc0638ae93982031db8c500370fa0677c4e4
SSDEEP

12288:ZeJek+27CECBPwyOD/m6IQJIuoHQA4dhJWJHMylfxs7TrA7l8kALT6o8wAvzP:Zb32GZhNOSGJ/GQA4Bbylf+7TrpHL+oa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PO 576060624.exe

Files

06062024_1708_06062024_PO 576060624.xlsx.7z
.rar

Password: infected
PO 576060624.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

XelK.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 705KB - Virtual size: 704KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ