Behavioral task
behavioral1
Sample
TR285.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
TR285.exe
Resource
win10v2004-20230220-en
General
-
Target
TR285.exe
-
Size
5KB
-
MD5
0f430d2e5078dea02dc36df9fb2ead25
-
SHA1
53cfadd1333fcc209bb71d3435862f2d3c0ac999
-
SHA256
8dd25b5662494e16c5a0926aa0439a249fe99eda604f86e2f523bb7404ccd476
-
SHA512
e8e8733de46b0849f7039715a38d0ea050b13fad3f0c839c86b30818469aee052003924e1557c4131f2b17a7c93e92ce50bf5005116de24c6888561ef13ba151
-
SSDEEP
96:j2gEM7kgUjqPlAoLrU73b+RZj0AwoLaunSmKk9XDgBzNt:jD0kl/L47r+Ttwjuj9zgD
Malware Config
Extracted
purecrypter
https://www.grandatek.com/siixgroup.com/panel/uploads/Edgibhm.png
Signatures
-
Purecrypter family
Files
-
TR285.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ