Payment for PO # 12946[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Payment for PO # 12946.exe
Size

702KB
MD5

1f4965bc1d07adade47c902d4e03e14d
SHA1

4b204d22013155f1bb630e1cabfa93159ded7d23
SHA256

ef0bcc41a6a2dfe53b3f0eaa491620527cc0968eb7d66d994291f06f2c6afb86
SHA512

60d04c69fdf19232a6027539be9dfcac689780d4c657dee3c782791a72863154be76411fcbc03aed68e7282063679c7d746f1fc196d73e0a5ad96196884b366b
SSDEEP

12288:b8X3inVFadHflREyJ03sE7j9H99ThUF2f2EBKmGXTxmemx:232H4lREyicAhTThUFpiKmGXm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Payment for PO # 12946.exe

Files

Payment for PO # 12946.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 690KB - Virtual size: 689KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ