Static task
static1
Behavioral task
behavioral1
Sample
rQuotation.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
rQuotation.exe
Resource
win10v2004-20240709-en
General
-
Target
rQuotation.exe
-
Size
3.4MB
-
MD5
b0311e8b008a534cbdd26beed988f2cb
-
SHA1
32e9e1aef7406bdc37068b038e23d72d800921d7
-
SHA256
f46bd2742e3e04bdef45224ba44ddaad2d53a96e27dbdf042106ade0c91c4810
-
SHA512
5973a185eb27806d642483ace209e367b8b0aab9acb507fd2e3e418a56091c7715f26933d2765564a71c049cad638341371a7dc223f5bbec39e236654698376e
-
SSDEEP
12288:7kT9kiEwCmI5M0tpu8ZSmcPCDR0iOTtOZB4P+9mSp4ysMqBh:op1CnF7u0gpOYPM4yy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rQuotation.exe
Files
-
rQuotation.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ