Rebel Installer[.]zip | Triage

Sharing

General

Target

Rebel Installer.zip
Size

431KB
MD5

6e8462b46cee1eee9cc7f7413235ecbf
SHA1

aff635780f373ae05a32101a48e2c15cfb6bd287
SHA256

75af2d096971923db1c9a6643d116272d31007a4d54ac223a970f624ef65a753
SHA512

08d0d285882f128e088c00944c534964478d0c2286e5551c930b0b8c5fb948b07296a770223d94e5d5f1498a454bbea59f0e80332f4dc333be78630e6604b45e
SSDEEP

12288:Pw1P1/GSfwPma0A4DArFkkqEPLCACBIu+OVG2FYvw:PG/GSfwvUqFkXAAIu+OVG2So

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Rebel Installer/Installer.exe

Files

Rebel Installer.zip
.zip
Rebel Installer/Installer.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 626KB - Virtual size: 625KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ