Pos[.]exe | Triage

Sharing

General

Target

Pos.exe
Size

1.7MB
MD5

fa7f8f7605655e3ab85686f3f9792fed
SHA1

b5268cde7fc1dfdf418d28b1a411686e1a1b2686
SHA256

6f7406c1ad01bb003a1e12069e7a47f885c5d531189d8257cec195045ff15f20
SHA512

e14240b6ee0c5331486b5e006f93deb70ee7d825e52c6dfb11e194190a2e9a2d5c603b4908d8ce9e85124ab190b831d0e684f2861ba164a88bdccf70943a34b8
SSDEEP

12288:N81gJHuPVjEk75E5VY3DhGcgg/qsUt26tWFrmFMY1h04UL6xkSNMtpePXLtUAz72:G1gJOtjHKm1Bfe0HekS+ePXLtjGt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Pos.exe

Files

Pos.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ