17082024_0200_15082024_Brightwell_Quotation[.]zip | Triage

Sharing

General

Target

17082024_0200_15082024_Brightwell_Quotation.zip
Size

534KB
MD5

0b2f753a08a7d1db6786effb4ff5f7b5
SHA1

118256834a4911a938b76cc87031fbac0a1b7ee8
SHA256

ac8c305fa80e80b4b56c8e7c66a0b1318a32961e6b1752ffa8490cee46069b24
SHA512

3e622dc608423a0c178ef353d346959de3c57c3e223327724d7acda8ea17101a7c8705c1100bf67e2d32abff4b664ff932fd142febaa845d2acd96625831c35d
SSDEEP

12288:+Bidc3NPSlKeg+KhiKHArARIVfepDIHncJn/XOw+9omObR9COZRr:+Adcd5G6gMRuGpZ+qmZOZRr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Brightwell_Quotation.exe

Files

17082024_0200_15082024_Brightwell_Quotation.zip
.zip

Password: infected
Brightwell_Quotation.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Ybah.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 542KB - Virtual size: 542KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ