PO390[.]exe | Triage

Sharing

General

Target

PO390.exe
Size

222KB
MD5

f178298c8228f9d40df7a950052f3f4a
SHA1

23be9ce5113bc109c379a510cf29dc1d868f992f
SHA256

15d4b385fa84855b067c70ce280cd4733eec0c0ae87c97f9dd42d82a374e0a3c
SHA512

be8c1d056a24e51631e764dabe98f940eacbd94a1978a18f72aaa840fe37481ed2ff6de8590cc16910f8339f2fa127390d221461e6bb857c5d74d9db114c7497
SSDEEP

3072:3fV9txAod96+LJHQTCtphcfl5AjF94sh5bzAxSY6nKOp8GuaTYuISxwr7TgGJyjU:3dDxhk+LJwwiQjFSs/Y6hpDuaTYxJTk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PO390.exe

Files

PO390.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 219KB - Virtual size: 219KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ