Behavioral task
behavioral1
Sample
c5f8a57e9e252306e9876a01fbc423420693bf04cf7c33fb0bbf972e34299f21.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c5f8a57e9e252306e9876a01fbc423420693bf04cf7c33fb0bbf972e34299f21.exe
Resource
win10v2004-20230220-en
General
-
Target
439c8eaf5105f874659e06ecca63e66b.bin
-
Size
4KB
-
MD5
4235833e23d4f5adc69d5b2a46c2f780
-
SHA1
0328971cff97ce0eca99e4c092781e0b4b51adb5
-
SHA256
0d96f74f664abe7e18701d5baf6b5340f8f0eb0eeb6ac6f428947c4a49b0b85f
-
SHA512
c7e8135d9963e4c5e1c63ec81bbaf03cf4b8dee98eb08cba24c9ebaa45a0af0472df5651a0291f7344b78b11f402177f8da3643d25441715d2da24fdc11430b3
-
SSDEEP
96:p6NNXAJOvwdlROCxqH//7NOBZBLJ9gkVPaKP1/an6Ns:p6/XAsYxw7oBZBLTYKPG6W
Malware Config
Extracted
purecrypter
http://www.ugr.leszczynskie.net/galeria/Xcilfp.png
Signatures
-
Purecrypter family
Files
-
439c8eaf5105f874659e06ecca63e66b.bin.zip
Password: infected
-
c5f8a57e9e252306e9876a01fbc423420693bf04cf7c33fb0bbf972e34299f21.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ