C0R543362T255141272[.]eml | Triage

Sharing

General

Target

C0R543362T255141272.eml
Size

973KB
MD5

d0a406be4ddd4af91614bd175c963ac9
SHA1

ea8db86d700291973fc1ae4407979607564dcc0d
SHA256

00725a01934a451cc96025ebb7110c2f3b32bbf3e5e14e9038b8d0d61fed4d90
SHA512

2cc6e29085c59e51b60d40ea53fa485e991ec013821ccf19e0201cc33d12628db49e710075f239dfa74bfaa1e0cb9e6af069a8612af6ed6585be0877314c4dc1
SSDEEP

24576:8U699xJndTEy5+dNDzl7CChmhU/nwe5HuJDU6vDcUNRn:8jrdA3nBefuHuxtr1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Bank Details-Confirmation.exe

Files

C0R543362T255141272.eml
.eml
- http://www.ewamax.com/
Bank Details-Confirmation.ARJ
.rar
Bank Details-Confirmation.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 812KB - Virtual size: 811KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
email-html-2.txt
.html
email-plain-1.txt
image001(2).jpg
.jpg
image002.jpg
.jpg