12092024_0752_11092024_PO82107048[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

12092024_0752_11092024_PO82107048.rar
Size

646KB
MD5

64d99efd8aed12a0cc34304e6ce71008
SHA1

cb61ec91ef9d31ebc642a1ea0dcaff1de3338019
SHA256

b9de6a8e1f3cc868f14b561d14fe42ad23aa5da1555bd27dff489ba1fb4c74a7
SHA512

c99dfb5ed8f910d5383e40ff7467864af2a2718ad3b56357a6ca5a0425d5895b7a88aebfb439accabb51d9afde08357d54d5fa1f8ff1c12e592448d0f5142bff
SSDEEP

12288:PcKqFs328a5/l8OK7a2YQVF3DfFsqhff7amFpsNVPK4Xq/Ey5IstuI/IZa:EhFiTaL8ha2YQ7Jhff7amFpsvPKSEEy7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PO82107048.exe

Files

12092024_0752_11092024_PO82107048.rar
.rar

Password: infected
PO82107048.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

oFmz.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 666KB - Virtual size: 666KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ