purecrypter | 10832829471[.]zip | Triage

Sharing

General

Target

10832829471.zip
Size

3KB
MD5

436d699fcc562020a0b16b1fcb46f3f9
SHA1

c751ed713dfadfb7010c980290383ff6df3b42af
SHA256

84fa72e64dbff9ed7dd9878f06a6754f2a670a6c75312247cee4840caa4d43c3
SHA512

2f9b105051f96f42a302b0c727fbb7b38b8d4552085a22d84fbb66bd7efc27de452c05c361005c252e094b5e50a29674be9784b7955bc1358378e41a0a8c97ba

Score

10^/10

purecrypter

Malware Config

Extracted

Family

purecrypter

C2

http://80.66.75.37/Nwhxelt.mp3

Signatures

Purecrypter family
purecrypter

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854

Files

10832829471.zip
.zip

Password: infected
d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ