14102024_1427_13102024_Re property pdf[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

14102024_1427_13102024_Re property pdf.zip
Size

636KB
MD5

ac950c8c9679bfb71c13fa99d6e06161
SHA1

dc0088962b4908c9a574ad20fd5544dff3ab4d14
SHA256

dff11d404134bc16c820c53e989b102ae774c41b14e14b5d346df3b6d18f7236
SHA512

cf41f135d5b5865b24dd25f55683ea07339351b54be52f2e127a73aa00e5d327472bfc0a3188072feca0216c7fbd2f7a81473dcb42e0c70159143aa0e157c49e
SSDEEP

12288:1RhfVHL6oLNKIsUbfxvBnym0PHgolbyL2K+P7A7//ZnZP:17VmuMUrDniPHgolbyL2K+P09p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Re property pdf.exe

Files

14102024_1427_13102024_Re property pdf.zip
.zip

Password: infected
Re property pdf.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 680KB - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ