rPurchaseOrder[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

rPurchaseOrder.exe
Size

421KB
MD5

a2c0d779c9d0318f12d6cd7ffb4ff38d
SHA1

e2175551806064fd5ecdca1ebd5e7fa3af98f95a
SHA256

7a60541acfe55640d7b996ca858b9631023bb98dde8e242b294903a9826870a9
SHA512

f66a7fead11d95656b4edf5e78ea915a05e44940a7508474d4f44db484d269c5b9fe72eb8e6f031263b310eefa79194dfc36044b0b80577de1f6501040f7a44e
SSDEEP

6144:cTr6MqD1G0igu9MCEw/5CUsgPTKBPGRot53qRpoS4lYUzBbeLh8czQ6pYi+NKuX/:/rD6NB6uRwqRpV4lYUzBbbn6pf6ww0K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rPurchaseOrder.exe

Files

rPurchaseOrder.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 417KB - Virtual size: 416KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ