P[.]O[.]exe | Triage

Sharing

General

Target

P.O.exe
Size

556KB
MD5

283809f80d5c24b3eb3e917a5b3c4c53
SHA1

1da1a8aec833aaa560e50170407f4d371b9cbca9
SHA256

31a702cd5ff00baefbeb5f301ca3015587a099b0046939cc3d1e8cd553eb3147
SHA512

792a0adcaefdb0e5bec5e820f1070bbd5235f1407638dc8365f56592a5947fd1c38d74ddd2d6fe29dab9e1d171ccee26638b10e4157e01304da228da7a162e2b
SSDEEP

12288:QgUSUpCEg1GSbvTOfkeepuEAewOlCXwxYsGpSuMDKaqfr2:Q+Q7g117O8FwEAeFlf8haN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
P.O.exe

Files

P.O.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Hbb.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 553KB - Virtual size: 553KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ