30072026_1631_30072026_NEW RFQ[.]tar[.]gz

General

Target
30072026_1631_30072026_NEW RFQ.tar.gz
Size 730KB
Sample260730-t1rf2acb99
SHA256 22d8a57bf689f048917ff8312f5074edf6ec905b2316f60d32dd71fefc9cb350
MD5 eb78f724eca51cf7b62fa31cb18e9cc6
SHA1 a10c681fee0d0e0fe9608eac0c4e67c6b2f9cec1
SHA512 aa81ff0808010a9cb99db0ce199cea98090893d396621a813a5aaf41fac8ce8870201402fad97782a28da0c070d5fa8b3dd3da969e7573447c14cc94aa8a900b
SSDEEP 12288:xyytFhgeyZ1hA2eZ0Zo3omfzW6aB4d5R63Csyr+RpJp2+d+DsVU0SNe9KMo:xyytg7k8FgzW6aBO763Cs4+tp2xabUv
TLSH
T189F43352A985D9FCC5FB99D4CA9113F0009CE3EA7D24AD3A54F2EBC16BA4322444DF36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/NEW RFQ.exe

File Explorer

30072026_1631_30072026_NEW RFQ.tar.gz

.gz 730KB
NEW RFQ.tar

.tar 810KB
NEW RFQ.exe

.exe 803KB

30072026_1631_30072026_NEW RFQ.tar.gz

SHA256 22d8a57bf689f048917ff8312f5074edf6ec905b2316f60d32dd71fefc9cb350
MD5 eb78f724eca51cf7b62fa31cb18e9cc6
SHA1 a10c681fee0d0e0fe9608eac0c4e67c6b2f9cec1
SHA512 aa81ff0808010a9cb99db0ce199cea98090893d396621a813a5aaf41fac8ce8870201402fad97782a28da0c070d5fa8b3dd3da969e7573447c14cc94aa8a900b
SSDEEP 12288:xyytFhgeyZ1hA2eZ0Zo3omfzW6aB4d5R63Csyr+RpJp2+d+DsVU0SNe9KMo:xyytg7k8FgzW6aBO763Cs4+tp2xabUv
TLSH
T189F43352A985D9FCC5FB99D4CA9113F0009CE3EA7D24AD3A54F2EBC16BA4322444DF36
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

NEW RFQ.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 30f8fdb26e5ef75f382fd927a35e00ea8accd504e677058b7fd28e6a73553d40
MD5 7311320686afe0a309586adb63442d46
SHA1 1dc70364adbe70b7f1396fb1ae54bd56769b1f4b
SHA512 80698de6b6f3c5140d6f44610d9d9b533a28904f32dc5494ca3e20eace94b9d2631294ac5c42ea41b998bef0fb818747204f3a487540d93527d33847274286d4
SSDEEP 24576:ueA9sc3qymb6fWdVLO1pGsy+Jp238NtpY3:PUs+5w6MVLO1wIp23a+
TLSH
T1D80502582A16EA06D99243B80BB1E3B417BC5DDDE820E3179FE9BDEB7629F444D04343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

827642

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

30072026_1631_30072026_NEW RFQ.tar.gz

NEW RFQ.tar

NEW RFQ.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

30072026_1631_30072026_NEW RFQ.tar.gz

NEW RFQ.tar

NEW RFQ.exe

mscoree

dotnet