PO[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

PO.exe
Size

444KB
MD5

db651c689991b70a8ad64b8e16d45e3d
SHA1

b5bc2bb05aff8ee7f747032558d608671952c4e0
SHA256

a4e0c337deb23abff2c5dadc07b49c95068653e811aad7995d0218691ab0077b
SHA512

d25098d7d278fbd2104a7bedf3307ca361d99252a3eca50a941ba5fa6e513b8c8699f4319eb368e691b2e92577cc558d8840d23d0538ba2182c860cc7a28d937
SSDEEP

12288:Elwb4jDFTidq3/RO7dE7syTg+5o0qy+oLQCCtpXEW9dL:EaUjAVDym1y8jE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PO.exe

Files

PO.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 432KB - Virtual size: 428KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ