EHDZ.pdb
Static task
static1
Behavioral task
behavioral1
Sample
quotation.exe
Resource
win7-20240903-en
General
-
Target
quotation.img
-
Size
1.4MB
-
MD5
99cd0f63ce6a4a909e6547284713218b
-
SHA1
6e62c7d313683f4cc0a6c60d307c4358f593bc86
-
SHA256
44b456884e9d95c9c39cdcec55e216a94d7c06a26d8e88b01afe63c705981276
-
SHA512
f9f280aaf1fd50acf07448e0d121fd09975ab1583cc2f296bc6de8b49154b7669cc3dce9449871504bd121f2130be7acfb016534d18e189f31b53822693be060
-
SSDEEP
24576:yiCtD/F2k78MTZjI/OuM+JEJBa5eZJTF9gH+dX:5mgk78MTZjQtuBa5eF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/quotation.exe
Files
-
quotation.img.iso
-
out.iso.iso
-
quotation.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 869KB - Virtual size: 869KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ