Behavioral task
behavioral1
Sample
rR40P23D.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
rR40P23D.exe
Resource
win10v2004-20230220-en
General
-
Target
rR40P23D.exe
-
Size
92KB
-
MD5
d40448b5ac56cf8f2a4bbea8d22982c2
-
SHA1
ad405a4f3ea892a80b696f7460de70bbb6b082f8
-
SHA256
d97bdbb4ad01f8873a141e7544160d070469b0c6865b823fec42184315b923cc
-
SHA512
be9b6ffda6ebee70baa79bab24129150895bf5d06f0d634a1099e129bd63396c2f73e1c82115b6ca37df5aa5c406e3d1df2932e9a8dbeb927aacda727675082d
-
SSDEEP
384:IiZHmh0O/Lrw+Ke8QEoDeJisnDPnFw5sglcMhQM0u+GrCPHFYgMSXA:IgGhHzr8e8B1PnFusmcDCXrCPqEXA
Malware Config
Extracted
purecrypter
https://ashaambulanceservice.com/Vuzbri.bmp
Signatures
-
Purecrypter family
Files
-
rR40P23D.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ