Behavioral task
behavioral1
Sample
swift copy.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
swift copy.exe
Resource
win10v2004-20230220-en
General
-
Target
swift copy.exe
-
Size
159KB
-
MD5
a05dab3d9ba8ee173ad40f31f0fa340a
-
SHA1
4c5edd5d59c7a3b79b148e3e2b91271f7364e9ac
-
SHA256
5020d7b12b16dc94b7850fd3e25189e2a5181657456c3322bc2168017f0d067d
-
SHA512
2135a9525edb31514a624efb62d1aeb8c4c0359caabe6e6b1eee7754ed92e6491e633861308dde58ed4961e1e5e0e3fc8068d00e0062a11f853c1f2f6d396c92
-
SSDEEP
768:dukr+M0fV7RW1JbUGmp7NxryR27zAFEzD/xworhq:duke7RAJu7vryR2XSWwOhq
Malware Config
Extracted
purecrypter
http://192.3.26.135/uo/Qjryxyrtsm.dat
Signatures
-
Purecrypter family
Files
-
swift copy.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 154KB - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ