26102026_1627_26102026_ORDER_QUOTATION_FORM[.]gz

General

Target
26102026_1627_26102026_ORDER_QUOTATION_FORM.gz
Size 711KB
Sample261026-tx9hfabe25
SHA256 0022f9de06b25c2b39a658111838defafe21dcadd7d61a23a3b2c9c74884fc99
MD5 de24197e14c8e74b83708d7f599fa53d
SHA1 f1b845032a55acfd907351e912dd7a5e60f4282e
SHA512 75545a41ab645697ad75dc359d5f7954b8faced43418ce8b6515ffcb1e121063fafa770f883a95238ac1aa0a98d6127d010c21e893a71f2704e84e5eb90bc015
SSDEEP 12288:MfA8BgjZV+wasavLp/Yakvdsd+lHOPzcM1wIlK3Wtnr0kV39x7DFEaRvX0:YA8BkpavLp/YagddBOL3lK8pVP7Oae
TLSH
T102F433043BB2933D0464499AA519D56AC0ED404FF4B349BCA2E3DCB72D47FD5A1EA2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ORDER_QUOTATION_FORM.com

File Explorer

26102026_1627_26102026_ORDER_QUOTATION_FORM.gz

.rar 711KB
ORDER_QUOTATION_FORM.com

.exe 825KB

26102026_1627_26102026_ORDER_QUOTATION_FORM.gz

SHA256 0022f9de06b25c2b39a658111838defafe21dcadd7d61a23a3b2c9c74884fc99
MD5 de24197e14c8e74b83708d7f599fa53d
SHA1 f1b845032a55acfd907351e912dd7a5e60f4282e
SHA512 75545a41ab645697ad75dc359d5f7954b8faced43418ce8b6515ffcb1e121063fafa770f883a95238ac1aa0a98d6127d010c21e893a71f2704e84e5eb90bc015
SSDEEP 12288:MfA8BgjZV+wasavLp/Yakvdsd+lHOPzcM1wIlK3Wtnr0kV39x7DFEaRvX0:YA8BkpavLp/YagddBOL3lK8pVP7Oae
TLSH
T102F433043BB2933D0464499AA519D56AC0ED404FF4B349BCA2E3DCB72D47FD5A1EA2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

ORDER_QUOTATION_FORM.com

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 34e5887dd33383ebaefa05e6237615463987affd4af6846163fba94221b0b435
MD5 aca797c1589207329745b4dfbd073867
SHA1 e7b1c7f0957b9b79c96547bf66d4391c046d04f6
SHA512 34e25496c3e576bf5744e36d85dfd14d155c1605e7dce1cee0b22dabb4ee019300d8c6ea57c8eaa117e8c4c32e57a9f97ce5f94d89140add7faf51b524d877cc
SSDEEP 24576:CSATMUVYjFxTaq2DeooG3Taws+yPGj+sooB6ZciXy:ycdCDs+yP1PciXy
TLSH
T1E805011935275013D9B26EF00D71E0B197762D6AB138E1954ECB1DABB9FBB10BE42323
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

807702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Administrator\Desktop\Client\Temp\DYeThFUiLQ\src\obj\Debug\Fpff.pdb

26102026_1627_26102026_ORDER_QUOTATION_FORM.gz

ORDER_QUOTATION_FORM.com

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

26102026_1627_26102026_ORDER_QUOTATION_FORM.gz

ORDER_QUOTATION_FORM.com

mscoree

dotnet