ShippingDoc[.]exe[.]xz | Triage

Sharing

General

Target

ShippingDoc.exe.xz
Size

644KB
MD5

98dcb2f078419d3917f2697e856d03bc
SHA1

2e7f0b548f449c726dbfd66d2a3f324203d463b0
SHA256

8276ec632025ab4adc6d3b6a32bf1401f73a30b88d8e17980d8c2c6078ab1d21
SHA512

bb1e2ff4c2bcd30d207aaba97f29dbd2cc81d9c65d54c466571e26d7a03247ac57ba2bcc82e2c87017aa074a5bf59e2debe4f260b3a082957afe51cdcfb4155c
SSDEEP

12288:Q9/Aw1gU9qdWx2Cbwcsx/uNvCfgLvPQtEN+LQd9vgY27JCl3GrdAJ7AR/haxjI:2YVUodI2Px/uNv7YN9CsrKpAR4x8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ShippingDoc.exe

Files

ShippingDoc.exe.xz
.xz
ShippingDoc.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

BJSo.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 725KB - Virtual size: 725KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ