General

  • Target

    4BDC37982E65F60E5F20F4868B4851F2B59BF7ACE5F723B6FDA011EE25285E01

  • Size

    295KB

  • MD5

    d61f40c75f47eb48ed1cf9f260a5e7ac

  • SHA1

    b7237d806312e558c2a31a38a47d69bbaeabad04

  • SHA256

    4bdc37982e65f60e5f20f4868b4851f2b59bf7ace5f723b6fda011ee25285e01

  • SHA512

    fdafcfa5d984499ded51ea8f87543817d13fe362e0eaa516eb2e7fb65c1ea45f03ea3154a5e261d1c57295e45c18059280111b461f5a2638aae12660293e29fd

  • SSDEEP

    1536:8W3JRZLzBJ5wGq4up0KjIko1EnTJgOiAOqZ8RzrWWmBSwGjols/ZL4vUAl:8WVzBJ5wGqpjIko1EVzGlfwGnJ2l

Score
10/10

Malware Config

Extracted

Family

purecrypter

C2

https://ashaambulanceservice.com/Vuzbri.bmp

Signatures

  • Purecrypter family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4BDC37982E65F60E5F20F4868B4851F2B59BF7ACE5F723B6FDA011EE25285E01
    .zip
  • Tb_Order_Receipt_Pdf.vhd
    .vhd
  • $RECYCLE.BIN/$I40P23D.exe
  • $RECYCLE.BIN/$I4FIL8H.js
  • $RECYCLE.BIN/$I5VEPRW.js
  • $RECYCLE.BIN/$IMH8R2U.js
  • $RECYCLE.BIN/$INQFVCX.js
  • $RECYCLE.BIN/$R40P23D.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • $RECYCLE.BIN/$R4FIL8H.js
    .js
  • $RECYCLE.BIN/$R5VEPRW.js
    .js
  • $RECYCLE.BIN/$RMH8R2U.js
    .js
  • $RECYCLE.BIN/$RNQFVCX.js
    .js
  • $RECYCLE.BIN/desktop.ini
  • System Volume Information/WPSettings.dat
  • Tb2_payment_receipt_pdf.vbs
    .vbs