PO[.]rar | Triage

Sharing

General

Target

PO.rar
Size

418KB
MD5

6dd7a42a2821b729dbe8b4a5171203e1
SHA1

f7b92d1a3257ab62afe5fa878cb0a7521aa7b3ea
SHA256

df794346989b73ae48577f0a09361088bf4d4653a31e0ed58739c921040bd9ba
SHA512

204aa7dd30580de1596dad88e442217ca835fa2c1d7be33c637974c66d2c0f031d06445a9a7c4b9a897151ee300fca1e8d50ea185ebab410e18a1474a667db9c
SSDEEP

6144:fYJOI7G5eemZ2hEotBlsfDdFwaBPoagUqGBX7vgzNOkI9MDaLq94rgAYNy6p:QJOL5fmZ2yot/sfXAaNqkUj+LfMAVW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PO.exe

Files

PO.rar
.rar
PO.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 770KB - Virtual size: 769KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ