PO[.]zip | Triage™

General

Target
PO.zip
Size 664KB
Sample240227-ltcejaeb6s
SHA256 31f2ab0bd4c2f7364ab138bddc3af955ae48157badbcbd5d0a6db1f588c47b87
MD5 23dd48f1bf41daaad2a145887b9ec044
SHA1 e3acb92e027c49a4b65b67ac47d1c7b83c9db1e4
SHA512 773e6b2dcf2dc49e3fae2f7f00cbf5432c65358d082580216535106152d5278b4c2d37001b45cfcff3dccce8566ca99b960a6bf29089923a5ed494a1852ea135
SSDEEP 12288:uoJO6qCUOgsRkkL/2f/HtYZTKqE7pcoI7HmaeqLcon6r85tpwdlg1bjj5SOh:ud6qskZtETK1FFIzXeQjnR5HMaB/h
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PO.exe

File Explorer

PO.zip

.zip 664KB
PO.exe

.exe 686KB

PO.zip

SHA256 31f2ab0bd4c2f7364ab138bddc3af955ae48157badbcbd5d0a6db1f588c47b87
MD5 23dd48f1bf41daaad2a145887b9ec044
SHA1 e3acb92e027c49a4b65b67ac47d1c7b83c9db1e4
SHA512 773e6b2dcf2dc49e3fae2f7f00cbf5432c65358d082580216535106152d5278b4c2d37001b45cfcff3dccce8566ca99b960a6bf29089923a5ed494a1852ea135
SSDEEP 12288:uoJO6qCUOgsRkkL/2f/HtYZTKqE7pcoI7HmaeqLcon6r85tpwdlg1bjj5SOh:ud6qskZtETK1FFIzXeQjnR5HMaB/h
MD5 SHA1 SHA512 SSDEEP

PO.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 e68a0da390baf3802baa117bce98b4b3bcbd4f0d0f1355df483d1c5366206921
MD5 540e585e51c9a466de5d467f6740d99b
SHA1 39dd8118ddb60954a0c603cbc4f4636565708d75
SHA512 bfc4c7c36a33c079aa08a2d75b1be8ff0316f202070b2c7a210b21e8e7e99f52cdba158196b108775b89bf3dcb575c7828b41721c57ba58e852b8505c7fbb646
SSDEEP 12288:nnQ2GO66qCUOSsRokLB2D/HnYZ9KqEJpcoWCladcon6W3HHI/pUmnZzBh3:nnQ2Gr6q0odnE9K1HFdcjnd3nqnHB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

707838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

NgGy.pdb

PO.zip

PO.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

PO.zip

PO.exe

mscoree

dotnet