6af18d2bd501d5e7c65c75807b61d751b880d5b0455418896bd32c531373142e | Triage

Sharing

General

Target

6af18d2bd501d5e7c65c75807b61d751b880d5b0455418896bd32c531373142e
Size

1.2MB
MD5

22e249012dbc0309609901a0585a1998
SHA1

8553210655b6754513a956dc2924251b7a712245
SHA256

6af18d2bd501d5e7c65c75807b61d751b880d5b0455418896bd32c531373142e
SHA512

074230d02ec09456f6c54bdc9af2493b3e968b067104337cf34f6805e7aa3b07defee6b434c3c94f88cef7008dac27a2cf0bea7846c04e6efa8b004907bf5687
SSDEEP

12288:5uM9hCaa+LNWB8cA7oCeN18w3S6shlcgpM6vfmhTs+YEdzB++D8zDQbyh0hyLX6:3U0gB8cAECo/CRlwSFwB++D8Wyehy76

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/RFQ URGENT STM POs L4962A 10K.exe

Files

6af18d2bd501d5e7c65c75807b61d751b880d5b0455418896bd32c531373142e
.iso
out.iso
.iso
RFQ URGENT STM POs L4962A 10K.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

NIpq.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 679KB - Virtual size: 679KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ