pomogator[.]exe | Triage™

General

Target
pomogator.exe
Size 3.4MB
Sample260916-vm3gtabg53
SHA256 30b936a9355a544c7037c87b9c692cf034965657e3c8364e24255056956d59de
MD5 c74deb614293f7387910e3e0c7f122a1
SHA1 e7995e84170b0b4c7da43bbcb5b369817bbe36d5
SHA512 24668fae7db5bbc7f53144b601398d198ad9109232449b5c69af98d3348ee53f51abf8c434b71712c27d0be168d51c29f7e1212ee99df932ac119fd3b9082098
SSDEEP 98304:HO6vmNhFeI3cP2hzsyt2i7cU1Eb731TTJk:HO6iZ3cPYzsyI41EnFnJ
TLSH
T1F4F5336AFCF27EF4E021A7327FAC3F15F3AE45094287153252A58F2D3956AD112E8C61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pomogator.exe

SHA256 30b936a9355a544c7037c87b9c692cf034965657e3c8364e24255056956d59de
MD5 c74deb614293f7387910e3e0c7f122a1
SHA1 e7995e84170b0b4c7da43bbcb5b369817bbe36d5
SHA512 24668fae7db5bbc7f53144b601398d198ad9109232449b5c69af98d3348ee53f51abf8c434b71712c27d0be168d51c29f7e1212ee99df932ac119fd3b9082098
SSDEEP 98304:HO6vmNhFeI3cP2hzsyt2i7cU1Eb731TTJk:HO6iZ3cPYzsyI41EnFnJ
TLSH
T1F4F5336AFCF27EF4E021A7327FAC3F15F3AE45094287153252A58F2D3956AD112E8C61
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

12930128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths