Yqer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
request for quotation rfq1310.exe
Resource
win7-20241010-en
General
-
Target
11112024_1303_10112024_request for quotation rfq1310.pdf.z
-
Size
575KB
-
MD5
d0e3402595c93e62421fc818c502e7eb
-
SHA1
27e648bcf54e4fd7a0df0916dd13999f6428e6e2
-
SHA256
8f454c054ddbaa1ad73297a3b9dfc69bc6d7d415757986c3141b821642a80754
-
SHA512
f9ea8d95bbd0ec4c124f23fb5b0dc75e3af55a3b87a79ceccdd9bbe706af251a4bdabacc7476c7b42885fcba90780a2e980aab5edfe4a8fc99b254efe9bd50ca
-
SSDEEP
12288:HFvW/TFkApL03ckPm1nZYG6uiDPsKCyYvXJL3Q98sCgiYkH7ga:HRWScL4MnebbBCywo881kh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/request for quotation rfq1310.exe
Files
-
11112024_1303_10112024_request for quotation rfq1310.pdf.z.rar
Password: infected
-
request for quotation rfq1310.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 761KB - Virtual size: 760KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ