shipping documents[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

shipping documents.rar
Size

716KB
MD5

4407cc4e9003edbb488251f9d2cba6ae
SHA1

c9202a417adc9b4a0563a648db9b9c159b49bcc5
SHA256

34ca9ee124922b436bec8ce1ac903f48d9dedb39ebd16f25287269edeb406e00
SHA512

cee848b023e4a671ef6c7f2b4ff43087403c8572934248d33c6bc8a866c4d8d705761ca8737a304b5ba211c79f1113e2033de8c4bfc07c128e02be33f8df7fe8
SSDEEP

12288:bdzkcfzeKHmfdJ5AKWUi/SbOCD1X+XG0zAGuXcrfo0bUnA6yPXBujIzfuhRJM+rl:bHzeKGfdni/qOCpXqzA7cc0bUnSP4czW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/shipping documents.bat

Files

shipping documents.rar
.rar
shipping documents.bat
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

XwJr.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 772KB - Virtual size: 772KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ