Behavioral task
behavioral1
Sample
104.168.46.126_-_o_-_b08.exe___cbcffdbddd074c247071caed0e162729.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
104.168.46.126_-_o_-_b08.exe___cbcffdbddd074c247071caed0e162729.exe
Resource
win10v2004-20230220-en
General
-
Target
104.168.46.126_-_o_-_b08.exe___cbcffdbddd074c247071caed0e162729.dat
-
Size
17KB
-
MD5
cbcffdbddd074c247071caed0e162729
-
SHA1
eec65a6aa6eaa1fa44b1832d405651e6dc87fe57
-
SHA256
2ad849391b902e19d516b7cd3eb0c1977eba5f39baf5f1e687ec09613866b721
-
SHA512
9adf006b456245c5332b0fb69d8f76b2c46a53b6658d69e179a8ed8cafda61b86e1000e7744eefc7568f9aea0e27053b57449be947846d4a9cf9f4b8a3fc8d92
-
SSDEEP
384:UoZHmnT8N7wgseoLf6VYgQE8AWilNekNek+vD7:UGG0cffgLo
Malware Config
Extracted
purecrypter
https://pentatunggal.com/o7/Dnivqllcmu.dat
Signatures
-
Purecrypter family
Files
-
104.168.46.126_-_o_-_b08.exe___cbcffdbddd074c247071caed0e162729.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ