Behavioral task
behavioral1
Sample
Kzzexzgao.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Kzzexzgao.exe
Resource
win10v2004-20221111-en
General
-
Target
Kzzexzgao.exe
-
Size
6KB
-
MD5
57fef8f1f5588749972ca86427a84ac2
-
SHA1
f02eeb37ab23baef39a9c473c0d140778eb89cd5
-
SHA256
940962a877f581558d30c735c4bc00fc43f46aea046ead732611a6647bcb19ae
-
SHA512
930b61e0f825afc2e8f05ec2937759cbfbfbcc9fea95a3d3da8f0967072761e2d1f8e93b47e171524aa2282e32048bc8a85e3ac524bcac6e2a8e15c020e9e074
-
SSDEEP
96:y84Z26fM8osEEa79lbJWFPATRyUoSRCQ1tAkA3wzNt:qbZo7+PgUDi/4S
Malware Config
Extracted
purecrypter
https://cdn.discordapp.com/attachments/1069503522103644191/1069548449265098822/Tnqrgaadbre.dat
Signatures
-
Purecrypter family
Files
-
Kzzexzgao.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ