purplefox | d062e6caa335496805db0ca03be48abc1e3281a20ec4d39f2db23630441d4efa

Resubmissions

04-01-2022 05:27

220104-f5fcnsaean 1

Sharing

Copy URL

Twitter E-mail

General

Target

d062e6caa335496805db0ca03be48abc1e3281a20ec4d39f2db23630441d4efa
Size

120KB
MD5

8e2a89b11885abe917aae5c34589f71e
SHA1

237deba57310abce208b49f756b1cdc80d76b03f
SHA256

d062e6caa335496805db0ca03be48abc1e3281a20ec4d39f2db23630441d4efa
SHA512

4f13ef378c89c75a77f0dca2fbb0a38591fdefb7d8f591a49a0edc15794bc05f941179d0a2bd3e2b6a70dc34ace63eb9021b4f0ae49b898af47be18355fc61f3
SSDEEP

3072:wsrBkQRqqzwBcFlCvqFiT4k7NLNU5vJ20:wI2NK2qk/U2

Score

10^/10

dropper purplefox

Malware Config

Extracted

Family

purplefox

http://193.164.223.77:7456/77

Signatures

Purplefox family
purplefox

Files

d062e6caa335496805db0ca03be48abc1e3281a20ec4d39f2db23630441d4efa
.exe windows x64

8c7a2087e32d0d923df57c2cdd7e54d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetFileAttributesA
GetCurrentProcessId
GetModuleFileNameA
Sleep
CopyFileA
FlushFileBuffers
CloseHandle
CreateFileA
WriteConsoleW
GetConsoleOutputCP
GetSystemTimeAsFileTime
GetLastError
DeleteFileA
GetProcAddress
GetModuleHandleA
ExitProcess
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
FlsGetValue
FlsSetValue
TlsFree
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
WriteFile
GetStdHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
HeapSize
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
CreateDirectoryA

user32

GetWindowThreadProcessId
ShowWindow
EnumWindows
GetParent

shell32

ShellExecuteA

urlmon

URLDownloadToFileA

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

Files

8c7a2087e32d0d923df57c2cdd7e54d7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

urlmon

Sections

.text Size: 59KB - Virtual size: 58KB

.rdata Size: 19KB - Virtual size: 18KB

.data Size: 6KB - Virtual size: 13KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 30KB - Virtual size: 32KB

.text
Size: 59KB - Virtual size: 58KB

.rdata
Size: 19KB - Virtual size: 18KB

.data
Size: 6KB - Virtual size: 13KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 30KB - Virtual size: 32KB