Yara398Bob[.]pdf | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Yara398Bob.pdf
Size

606KB
MD5

c1b11c84f527dcffd10c498b7c69bbf2
SHA1

752b95a547fa204ff725428ae7043dacf5e18b56
SHA256

509c592f3af8835bd9acf61dfdb419ff143bb1dcf35fc9c4a86cfe32a8df04f1
SHA512

75d6aa221da01724cbb808b5994712821524c6be5c1d3a2f529c41cc86f7abab1356b44dec981422780f7159960fdc6487e1f3262c00dbae571c79251a989d37
SSDEEP

12288:ZmfrraF+tTw/2U3L+tEAu+7GA0eCjTJKMtD43ZQYBT2jmMSbBgmRhaaMv2pZn5+/:ZmY+tsnL+iAw2p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Yara398Bob.pdf

Files

Yara398Bob.pdf
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 595KB - Virtual size: 595KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ