rock_projects_salzkammergut_pdf[.]7z

Sharing

Copy URL Twitter E-mail

General

Target
rock_projects_salzkammergut_pdf.7z
Size 4.5MB
Sample260808-qdebeadf42
SHA256 7c92408ee85f3ef6611aca5a195028bb4eb81d6dd8c62e47c3f876ab57b90a10
MD5 9cad730e50980b4bf2a65feafd2e0590
SHA1 38993ebe738a10ef189fc1be68b7b8366a5f4c40
SHA512 1568a688b427f6ef575d3a7c34bce7f429d1a1f5f34543ce47d95ad5999277019a87ee74eb52d358028149db22f04ddc1138f57de2baa2003640d57c43144631
SSDEEP 98304:sG7qnaasrPSr8NU00fR988on1Ej5EuhF/1wz+OAqQ:sGGnc2gKfZO/1EVEuhF/1Jb
TLSH
T1FE263376022BB12D89FBB1B4938DA2854CF07B737C1257C0FBF954A2480C989AEE755D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/rock_projects_salzkammergut_pdf.exe

File Explorer

rock_projects_salzkammergut_pdf.7z

.7z 4.5MB
rock_projects_salzkammergut_pdf.exe

.exe 879.5MB

rock_projects_salzkammergut_pdf.7z

SHA256 7c92408ee85f3ef6611aca5a195028bb4eb81d6dd8c62e47c3f876ab57b90a10
MD5 9cad730e50980b4bf2a65feafd2e0590
SHA1 38993ebe738a10ef189fc1be68b7b8366a5f4c40
SHA512 1568a688b427f6ef575d3a7c34bce7f429d1a1f5f34543ce47d95ad5999277019a87ee74eb52d358028149db22f04ddc1138f57de2baa2003640d57c43144631
SSDEEP 98304:sG7qnaasrPSr8NU00fR988on1Ej5EuhF/1wz+OAqQ:sGGnc2gKfZO/1EVEuhF/1Jb
TLSH
T1FE263376022BB12D89FBB1B4938DA2854CF07B737C1257C0FBF954A2480C989AEE755D
MD5 SHA1 SHA512 SSDEEP TLSH

Password

2057

rock_projects_salzkammergut_pdf.exe

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 7064d2918495f258cfda83df4e4b42b6aa087cb509b3126768c6ef59ea7d57e9
MD5 c1478ad77310bb42791955179e7a6548
SHA1 6f943b9558860c9ad730edaebc02b4a87a44748d
SHA512 6406377cf352fe17003191c7f661f9b332dbe45f84a1c3196911df2df2ca1599df77975587416d3ceb22a4d6cdd93a075b63353006a2f1608cad419d5fc57c1d
SSDEEP 98304:Q4LeIQhnzeSPUyxfnwkrV40pNAKZEoT1nN5AF:QWeJnzNnxfnXDxMF
TLSH
T12FA9AF03BBE404A5D0AB973089B79652BB35BC494B30A3DB2A60B67C2F737D09E35751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

2057

Minor OS version

Major OS version

Entry point

481504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128KB

Virtual Size

421KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

rock_projects_salzkammergut_pdf.7z

rock_projects_salzkammergut_pdf.exe

kernel32

generic