Static task
static1
Behavioral task
behavioral1
Sample
PO.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
PO.exe
Resource
win10v2004-20230915-en
General
-
Target
5f1e4e1092b018f05e05abda304efa93f30fc87b51914660d9117867f45da188
-
Size
694KB
-
MD5
339d1ef5b6e5a74b167a81664c7559a3
-
SHA1
bbbe7d74c49e06a2ad54bb2671734561f1fcf68e
-
SHA256
5f1e4e1092b018f05e05abda304efa93f30fc87b51914660d9117867f45da188
-
SHA512
766d62a7a05ac0d5cb469b542036d4c67e9997158b3754070c390b7775ad34475be1aceff451d074c7bccca37c3baeeae092b38218b7188769a883ede12c1a1c
-
SSDEEP
12288:nf1kvw84vAVFIzE2Nv7aOBWbXBo3ZMD1WxjDwdXcp0ZK9RgE/8w4JFq3g0mX8W6B:UXI/VfBWbRMDwlcx9Rgy/iqiX8l
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PO.exe
Files
-
5f1e4e1092b018f05e05abda304efa93f30fc87b51914660d9117867f45da188.rar
-
PO.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 660KB - Virtual size: 659KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 192KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ