purplefox | 3ec149660a6808f711ca6cb6b20c1dda[.]exe

General

Target
3ec149660a6808f711ca6cb6b20c1dda.exe
Size 658KB
Sample220122-jyv2bsaddr
SHA256 2d288f2cd6752a01360f2669959e2c61f676f8156d5cc40d4b415245ae04cf6d
MD5 3ec149660a6808f711ca6cb6b20c1dda
SHA1 45c3d1d8dd512c01fd6c897c67b35c13c49828cb
SHA512 3a15e7bfbabeb296001086453320a133dc242ef170ccf45d459d2a7f402fadfe3329099d79b368416d565ba0c16eb051b64fe7b756c21f822ab49ec483b5649d
SSDEEP 6144:iKDggLeO+QiXhxkwN4LTZZbY/9qnkZy7uPjldp/jq:iKDgNO+QiXhxX4J0qnWjF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dropper purplefox

Malware Config

Extracted

Family

purplefox

C2

http://107.151.94.70:4397/77

Signatures

Purplefox family
purplefox

File Explorer

3ec149660a6808f711ca6cb6b20c1dda.exe

.exe 658KB

3ec149660a6808f711ca6cb6b20c1dda.exe

IMPHASH 9c7cdf472434e99b4d5708b7fb3ea6ab
SHA256 2d288f2cd6752a01360f2669959e2c61f676f8156d5cc40d4b415245ae04cf6d
MD5 3ec149660a6808f711ca6cb6b20c1dda
SHA1 45c3d1d8dd512c01fd6c897c67b35c13c49828cb
SHA512 3a15e7bfbabeb296001086453320a133dc242ef170ccf45d459d2a7f402fadfe3329099d79b368416d565ba0c16eb051b64fe7b756c21f822ab49ec483b5649d
SSDEEP 6144:iKDggLeO+QiXhxkwN4LTZZbY/9qnkZy7uPjldp/jq:iKDgNO+QiXhxX4J0qnWjF
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

9872

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadLibraryA GetProcAddress GetModuleFileNameA Sleep CopyFileA CreateToolhelp32Snapshot Process32First Process32Next CloseHandle CreateMutexA GetLastError CreateFileW FlushFileBuffers GetConsoleMode GetConsoleOutputCP SetFilePointerEx CreateDirectoryW GetProcessHeap HeapQueryInformation HeapReAlloc HeapFree GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCommandLineW GetCommandLineA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleFileNameW GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapAlloc HeapSize HeapValidate GetSystemInfo GetFileType OutputDebugStringW WriteConsoleW LCMapStringW MultiByteToWideChar GetFileAttributesExW DeleteFileW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo

Name

.text

Size

245KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

313KB

Virtual Size

316KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

3ec149660a6808f711ca6cb6b20c1dda.exe

kernel32