11092024_1310_10092024_Shipping Documents[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

11092024_1310_10092024_Shipping Documents.rar
Size

668KB
MD5

aac08b95cc063610be6a0b6680f6739c
SHA1

d784bb275ee5c8da6cf77e4a41f8fa8b4cf7face
SHA256

69934ee5027d9408032c418314adddd8dcf73ce8319dcf3d1c7358585af6c92a
SHA512

37041392270c446ec90003dbcd12724733f759654909829fa529bead908d6c0c987dffd73a1f644d813292c10a3696fdf6bb6bb78bfb218da56850f7ca88376e
SSDEEP

12288:NxWPkI36LU2nHiXPktEb5FEOlmhnrFeMvGBZPf/Gx4SSNIofb5H7lIe4U:w56LU2HkskFEOlmhrYXP3w4flD17ae4U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Shipping Documents.exe

Files

11092024_1310_10092024_Shipping Documents.rar
.rar

Password: infected
Shipping Documents.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

WYLI.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 827KB - Virtual size: 826KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ