Static task
static1
Behavioral task
behavioral1
Sample
Quotation_pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Quotation_pdf.exe
Resource
win10v2004-20240802-en
General
-
Target
24092024142123092024Quotationpdf.tar.gz
-
Size
859KB
-
MD5
4a09557ee8aa9f04475b7b2063f54c2f
-
SHA1
8e10171e9d8b93edcfceb1efa534c0fd6b523c5c
-
SHA256
154cf5e736dcc256fa3d229d1f0dcb4b29ac28081044757c5ae451ddf276c7b0
-
SHA512
be1eaba29b6a9afd3735051330316d039e8e70c1d4c080e2bafd81ce6563dbdec46e951af41d117124f4ec37145b079cfb012876565b9104c25ae1fb72f80acb
-
SSDEEP
24576:d9FksgZ6pIKNKyNIm+6KNcatgSNshvEWOboyfd:Pty6pdnDxOcauSaEWOzfd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Quotation_pdf.exe
Files
-
24092024142123092024Quotationpdf.tar.gz.gz
-
Quotation_pdf.tar.tar
-
Quotation_pdf.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 874KB - Virtual size: 873KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ