General
-
Target
pawno.exe
-
Size
297KB
-
MD5
325558d389c149c420a2753e0d163d09
-
SHA1
3d1ac2fafe3ce5f5348a77c891074551a51e8fda
-
SHA256
796a94ddcdb41b32d32bee020ca85371cf6bbeb968036448d0e3b0b559d7e90b
-
SHA512
182358763d3565c4d29b51479eafeeee060b876a3884d7636caa47152d0edee1b531db955664f14e5b03e1820d960a2a532444b33702acb1a6b23b1bc450ce8e
-
SSDEEP
6144:8qV54oUeSsMY3j0cI8rdYEylF2EHJ8Sj6vzHrh8wDVU3wMs9ZFW:8qV5dU7oTWKYEEF5J87vzLh8aVJS
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource pawno.exe
Files
-
pawno.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 540KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 287KB - Virtual size: 288KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE