PO202501F[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

PO202501F.exe
Size

718KB
MD5

4e4fb45c99a574849a086232116f8bfc
SHA1

ee52062d05ff64cb7fc57bc647535929cbe856d9
SHA256

b541d2f2c3ea6e6f3cb26bba9bf36a0034a01cbb225e794c94ff957d09991e77
SHA512

2ec98860cba067f2a60fe0e9819b390bbec6536ddbf2b06a5a9a65b8a450dba013a763b00f2a850444d92532233ec5c2c825163ea38755830c9303fea3350ef7
SSDEEP

12288:Aoe7DH/meETdAAHOPaLsegLyjR0SxJxycahXjIC72:g7DQAC0aLoL8RNrycahTt72

Score

1^/10

Malware Config

Signatures

Files

PO202501F.exe
.exe windows:6 windows x64 arch:x64

ce892e0a1e55ad6398810c351751078d

Code Sign

14:31:16:18:dc:84:87:0f:ba:60:68:d3:35:a9:2d:0c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17-01-2025 02:22

Not After

17-01-2026 02:22

Subject

CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15-01-2024 00:00

Not After

14-04-2035 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22-03-2021 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9b:67:28:e9:21:6f:07:b9:45:b5:eb:78:8c:5e:cc:d3:49:3e:a7:61:7d:43:0d:24:eb:be:b2:68:52:03:52:fe
Signer

Actual PE Digest

9b:67:28:e9:21:6f:07:b9:45:b5:eb:78:8c:5e:cc:d3:49:3e:a7:61:7d:43:0d:24:eb:be:b2:68:52:03:52:fe

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wldap32

ord13
ord144

wininet

InternetCheckConnectionA

dwrite

DWriteCreateFactory

api-ms-win-core-path-l1-1-0

PathCchCombine

pdh

PdhCloseQuery
PdhOpenQueryA

ncrypt

NCryptFreeObject
NCryptOpenStorageProvider

kernel32

GetStringTypeW
SetStdHandle
GetFileType
GetProcessHeap
SetEnvironmentVariableW
GetEnvironmentVariableA
ExpandEnvironmentStringsA
CreateDirectoryA
CreateFileW
GetLogicalDrives
CloseHandle
GetLastError
InitializeCriticalSectionEx
GetConsoleMode
Sleep
FlushFileBuffers
CreateProcessA
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryA
LocalFree
CopyFileA
FreeConsole
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
FreeEnvironmentStringsW
TerminateProcess
GetConsoleOutputCP
SetFilePointerEx
WriteConsoleW
DeleteCriticalSection
RtlVirtualUnwind
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapAlloc
HeapReAlloc
HeapSize
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RtlUnwindEx
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
CompareStringW
LCMapStringW

advapi32

OpenTraceA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
SetEntriesInAclA

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize

shell32

ShellExecuteW
SHGetFolderPathA

msi

ord141

d3d9

Direct3DCreate9

ws2_32

WSACleanup
WSAStartup
socket
closesocket

Sections

.text
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.DENUVO
Size: 368KB - Virtual size: 368KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce892e0a1e55ad6398810c351751078d

Code Sign

14:31:16:18:dc:84:87:0f:ba:60:68:d3:35:a9:2d:0cCertificate

Extended Key Usages

Key Usages

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

9b:67:28:e9:21:6f:07:b9:45:b5:eb:78:8c:5e:cc:d3:49:3e:a7:61:7d:43:0d:24:eb:be:b2:68:52:03:52:feSigner

Headers

DLL Characteristics

File Characteristics

Imports

wldap32

wininet

dwrite

api-ms-win-core-path-l1-1-0

pdh

ncrypt

kernel32

advapi32

ole32

shell32

msi

d3d9

ws2_32

Sections

.text Size: 179KB - Virtual size: 179KB

.rdata Size: 49KB - Virtual size: 48KB

.data Size: 3KB - Virtual size: 15KB

.pdata Size: 8KB - Virtual size: 8KB

.fptable Size: 512B - Virtual size: 256B

.rsrc Size: 98KB - Virtual size: 98KB

.reloc Size: 2KB - Virtual size: 1KB

.DENUVO Size: 368KB - Virtual size: 368KB

14:31:16:18:dc:84:87:0f:ba:60:68:d3:35:a9:2d:0c
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

9b:67:28:e9:21:6f:07:b9:45:b5:eb:78:8c:5e:cc:d3:49:3e:a7:61:7d:43:0d:24:eb:be:b2:68:52:03:52:fe
Signer

.text
Size: 179KB - Virtual size: 179KB

.rdata
Size: 49KB - Virtual size: 48KB

.data
Size: 3KB - Virtual size: 15KB

.pdata
Size: 8KB - Virtual size: 8KB

.fptable
Size: 512B - Virtual size: 256B

.rsrc
Size: 98KB - Virtual size: 98KB

.reloc
Size: 2KB - Virtual size: 1KB

.DENUVO
Size: 368KB - Virtual size: 368KB