Behavioral task
behavioral1
Sample
04604299.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
04604299.exe
Resource
win10v2004-20230220-en
General
-
Target
04604299.exe
-
Size
8KB
-
MD5
479ef78157265f023025dbdb69cdad17
-
SHA1
1d80e1ae39482182f8af54e32a3107f5536d63f4
-
SHA256
7aae9c3c1ffb5983de4c595a757f5f3d970ee895a17948aa17394cabd2910d78
-
SHA512
f9334fe20d2e734b4461134e15e82473a8161860f98a6b3e58b80d65f239f64ae6eabd08f5bc53e7e1de22d1074d8fbc2af94592d9aaae26549392787926e363
-
SSDEEP
96:Nlv8wBZsgB11/Qp4eqIulLLVeVgVlpxbEPWgidtiEllAHBzNt:LvtNGulLLVeSVPxAmf+HD
Malware Config
Extracted
purecrypter
http://purecry.ydns.eu/pure/Ximhh.dat
Signatures
-
Purecrypter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04604299.exe
Files
-
04604299.exe.exe windows x64
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ