RFQ_5729400129[.]xll | Triage

Sharing

General

Target

RFQ_5729400129.xll
Size

3KB
MD5

d1a5639d720b895c6f9bea976788777b
SHA1

0dec9cc7efa216f1088debf0d42c517d1c31f95e
SHA256

65bab37bd3f4aafb41808b286af3e32ab794420c0ed48b880160556e96c0d107
SHA512

7da73d97c4335f164ca9ff2555c905b2782243163f13a4a24f494e2446d6a89a1b6780eae0302b6f332fbd48963b3334f414924ce48e87e478592fc7809b0f40

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RFQ_5729400129.xll

Files

RFQ_5729400129.xll
.xll windows:1 windows x64 arch:x64

498a635594568c2b530f639a76e1dff1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CancelWaitableTimer
BackupWrite
DebugActiveProcess
FatalExit
ReadConsoleOutputCharacterW

gdi32

GetWinMetaFileBits
Rectangle
GetPixel
DeleteDC

oleaut32

RevokeActiveObject
VarI4FromR8

user32

EqualRect

Exports

Exports

xlAutoOpen

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 71B

IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ