Static task
static1
Behavioral task
behavioral1
Sample
PO.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
PO.exe
Resource
win10v2004-20230915-en
General
-
Target
PO.exe
-
Size
592KB
-
MD5
2b17ef662bfb9464153c8dbd60ccbad9
-
SHA1
a2883daa62d0f99d6cbf8b51b28d3f479c3807dc
-
SHA256
ad21aff38e3b20ca7c9c7236977dfb0821d515962cb5c705d8a5b9a8cbc43859
-
SHA512
e0cb94d546284ee3400a2e8f372b3365c0686ae5a6265b6bbd598f33d677d0582d29e0b6ef33dbadda496f89089a89a3bc9ead862708c4f19a7a5c96793284b4
-
SSDEEP
12288:Wi+rhsEgj79G/vpZyofAj+KD5icYPahZ:zITpq5icYPahZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PO.exe
Files
-
PO.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 428KB - Virtual size: 427KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 163KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ