Behavioral task
behavioral1
Sample
2d288f2cd6752a01360f2669959e2c61f676f8156d5cc40d4b415245ae04cf6d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2d288f2cd6752a01360f2669959e2c61f676f8156d5cc40d4b415245ae04cf6d.exe
Resource
win10v2004-20220812-en
General
-
Target
2d288f2cd6752a01360f2669959e2c61f676f8156d5cc40d4b415245ae04cf6d.zip
-
Size
143KB
-
MD5
665c435744282fed9dc8d09bbedb298e
-
SHA1
6a3ce1e2226a616999461e977a66489ffdd56cba
-
SHA256
86cd935a57c666b1c290c27ed6a31584ea0d294e14af9e394adcf4c3256fd330
-
SHA512
e43f7b0b7714fe59e56bb822e009c836ad3d78f3d7aac1ccbf928a1db4810f67088d104f64094579b70e514c099122a6460b124ad7dcf373db53b66a74937a89
-
SSDEEP
3072:ZuWh/GXhYPlFH2r/HbZK/GSmI0OsOWu3+wKiJMwxSM8OGDKmfN4jhpd:CXWi/HFK2Irs9hwzN9GOW4nd
Malware Config
Extracted
purplefox
http://107.151.94.70:4397/77
Signatures
-
Purplefox family
Files
-
2d288f2cd6752a01360f2669959e2c61f676f8156d5cc40d4b415245ae04cf6d.zip.zip
Password: infected
-
2d288f2cd6752a01360f2669959e2c61f676f8156d5cc40d4b415245ae04cf6d.exe.exe windows x64
9c7cdf472434e99b4d5708b7fb3ea6ab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryA
GetProcAddress
GetModuleFileNameA
Sleep
CopyFileA
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
CreateMutexA
GetLastError
CreateFileW
FlushFileBuffers
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
CreateDirectoryW
GetProcessHeap
HeapQueryInformation
HeapReAlloc
HeapFree
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
GetStdHandle
WriteFile
HeapAlloc
HeapSize
HeapValidate
GetSystemInfo
GetFileType
OutputDebugStringW
WriteConsoleW
LCMapStringW
MultiByteToWideChar
GetFileAttributesExW
DeleteFileW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
Sections
.text Size: 245KB - Virtual size: 245KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 79KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 313KB - Virtual size: 316KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ