Rebel Installer (3)[.]zip | Triage

Sharing

General

Target

Rebel Installer (3).zip
Size

463KB
MD5

8932b65b4f47e97017330f66269f2e53
SHA1

6b451e89c660a0042185c519479f4c3f7c8f8074
SHA256

2ead676ca360e946834975078a7a0a2f6b270c32fd4f18bae767f3a9c6f2a1a9
SHA512

2675d854dfcd00143d59e3d8b9040bbeb8ce5f4353129f130b032c23d07ee43f6316d83c7a93a8e92a461494c13e67d1c1eb049229f14395e6cd5d08d36df209
SSDEEP

6144:dReNcwUVMfkubcFGUG6Py1vrUmenA8EaRuZg6BiVGNuXUAAg+W8u/YBTK/3+3gt:LnRuUG6PytSA8vR0nhNu+Pueyt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Rebel Installer/Installer.exe

Files

Rebel Installer (3).zip
.zip
Rebel Installer/Installer.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 675KB - Virtual size: 674KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ