Erp7[.]Pos7[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Erp7.Pos7.exe
Size

505KB
MD5

e26def6a1b7d91d72c742aba52b7768e
SHA1

2e6b37317ab152c5cfaa6a57555b189ff73ab0e9
SHA256

a193c701ff7b5f302c4748e38c82ebae382f64d779ac6fc6a9a667babe6de9da
SHA512

d6d61727415612e2f4004b1f9e80671d7a561de2f2f8381d9f52db242f2b42d5d642e87503671c1962c100fd457d33392ddc86fd65d0f2837ada57e7b6375254
SSDEEP

12288:tZB601ZGRFnKsoVritqoLleeewlpvPzBVq2sD:5lZe+GtqzRwll1VqT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Erp7.Pos7.exe

Files

Erp7.Pos7.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 452KB - Virtual size: 451KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ