PO SENDFAFE600[.]exe | Triage

Sharing

General

Target

PO SENDFAFE600.exe
Size

1.0MB
MD5

ecbfd514f4c2e49d00cfc028f79b8de9
SHA1

c6fad2f3781b734690d9fb7cc3e44c5ae6ce16dd
SHA256

c5f12df3ea1a353211d78d2fee55c7efdf9ff6ada6ec21ffb513661734072543
SHA512

07a18904309f1b9ab99d3bb96386836739e00b851649ffa2ac7a66b8ecd10bfe9571980a080fdac7234f86bdcba34216905b1ca45cdb3a1dbe9cb9c261aeab49
SSDEEP

12288:vETzHr7FLOYmpEzAZ3wSCB93O7P+qnAivnyo9rMS9NaWoH8J5s1pkvgV:KNL2+zAaO7P7nAEyo+S9UVHmuog

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PO SENDFAFE600.exe

Files

PO SENDFAFE600.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

eXlk.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 775KB - Virtual size: 774KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 291KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ