Behavioral task
behavioral1
Sample
POdocsx.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
POdocsx.exe
Resource
win10v2004-20230220-en
General
-
Target
POdocsx.exe
-
Size
6KB
-
MD5
453b9d2e21ab4965444c1266fca02cf2
-
SHA1
16ee3b13e98daa37d69b22ca4b4979fd46a22f11
-
SHA256
ed1cc576fdd8b85cbef3cf6c587bd23991bf6427d6de38c82bbff8b4419e39bf
-
SHA512
7fe690048bb763315d977805ccd083516b29f09b20df14a50ba8fec5fad20ddce1d89ecf59ce0d9a935d42de943066371ba18da280e2f58b2fcfc0ef54449170
-
SSDEEP
96:+B7LfLooht25dmeU/R1QFBQdU6Ro0eSb/Ik9zNt:+BH2rZU/MFBwUyodGj3
Malware Config
Extracted
purecrypter
https://dweb.link/ipfs/QmVTrwuknBf6QyeA2UHcHCzRr3r1qs8ppnU6hnun5FypKR?filename=Iokleog_Jkccwzyt.jpg
Signatures
-
Purecrypter family
Files
-
POdocsx.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ