win32-quickq1[.]2[.]exe[.]v | Triage

Sharing

Copy URL Twitter E-mail

General

Target

win32-quickq1.2.exe.v
Size

120.0MB
MD5

eb64c7f8e9d2e7fdbab196dcf817a1cf
SHA1

c6af8b80f709cc5f07584e06601f8afb682ca48b
SHA256

898d72be01f5231447392f779189fe474b6f19cb7a204981f77368c1dd890f23
SHA512

fad05c98ec1b36640ab08aced89c2e310dd3964d1b982c69f82cd966c0f7da6842ac72cec01e9194ef851deec1bdc84665fd3afba895da6ea18923f297ff9b6e
SSDEEP

3145728:5QwQQ81Cvz+8qC2G3fwe8O2YxkkCa+w0SPh5BU70yfJS:yxQ2CvhPpnxKJwdJ1yf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
win32-quickq1.2.exe.v

NSIS installer 1 IoCs

resource	yara_rule
sample	nsis_installer_2

Files

win32-quickq1.2.exe.v
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\source\repos\JJDDZ\JJDDZ\obj\Release\Koretest.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 120.0MB - Virtual size: 120.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ