Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v2004-20240426-en
General
-
Target
6a1cdbf0b483b218690f3b94a7870f9800c2e77a03febde2d06093adcbff9c92
-
Size
688KB
-
MD5
fd3f4e65a4442a24942edb447c6ee20c
-
SHA1
6369c092b16ee8f367328a683b60e01d1311519b
-
SHA256
6a1cdbf0b483b218690f3b94a7870f9800c2e77a03febde2d06093adcbff9c92
-
SHA512
1bbf03ef5295fa70e16b579a4010bde688f8764a7011da61aa8ba06a129385c158ab153426caf2b5ab9019a9a0d5d0785009a6866034bd6b6dea5fc5d05e47be
-
SSDEEP
12288:Oz/5l3iIOXzICqIDIUA26NBzwhieTX20ebPVQRrOXjd/VJhWcCRH6dxBCiRmpqbX:OzveBsV26N6hiAX2FQRrOXh/LhjCROT/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Quotation.exe
Files
-
6a1cdbf0b483b218690f3b94a7870f9800c2e77a03febde2d06093adcbff9c92.zip
-
Quotation.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 702KB - Virtual size: 700KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ