poshsecframework[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

poshsecframework.exe
Size

1.3MB
MD5

d79e6cdbc6a54f4f95d1eb79a3a6a4d2
SHA1

ba58e99ad83daddfaca9f75eeaca7d3d5b662994
SHA256

0feb8a503431d8978d6523bfe230f6e3e4503ba84d1924332b52b97531c7da96
SHA512

e9563d25d8a7aae241fdf240646ef5c7bc2140fa988ac1cd80f948d9bf97502b079aa712f6440a6b08dbc768281f50383cb684b9d47bc1841d2b90c4d2fee08f
SSDEEP

24576:e6Tt8mkHA8mkHdo8mkHpjcZfME8mkHs8mkH:d8mkHA8mkHdo8mkHpjcZfME8mkHs8mkH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
poshsecframework.exe

Files

poshsecframework.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Users\Ben0xA\Documents\GitHub\PoshSecFramework\poshsecframework\obj\Release\poshsecframework.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ