Static task
static1
Behavioral task
behavioral1
Sample
PO.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PO.exe
Resource
win10v2004-20240226-en
General
-
Target
05ab73be8a170396164d6e3166e195c8688d384a3da3b29cd7efd6a4a161286a.zip
-
Size
254KB
-
MD5
0bad15184fab095c3c2969b1bb88a0ed
-
SHA1
e7e7ee3dc9d120f1c21c6e237efef4d66f314dec
-
SHA256
05ab73be8a170396164d6e3166e195c8688d384a3da3b29cd7efd6a4a161286a
-
SHA512
f0e817e5082ddd18bb3483cad3787dbd3477f4b1d636f04f1ea1d6abc782d61d2479ed5f8f31b72eec74b2aac787171353ea0aba27164d670b98ad701c7c907e
-
SSDEEP
6144:Iy7xGqQMMNIP3NxV58JNm8T3goyxb4pB67cc199X9Y:IsPiGdxMT3PCb4K7ccb9X2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PO.exe
Files
-
05ab73be8a170396164d6e3166e195c8688d384a3da3b29cd7efd6a4a161286a.zip.zip
-
PO.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 332KB - Virtual size: 332KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ