Behavioral task
behavioral1
Sample
3848-7213-0x0000000005440000-0x0000000005450000-memory.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
3848-7213-0x0000000005440000-0x0000000005450000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
3848-7213-0x0000000005440000-0x0000000005450000-memory.dmp
-
Size
64KB
-
MD5
7615776c5da2f38b707f17c65748c8e4
-
SHA1
00e87d4ba8da7052c67d4f9099e469ed989425ea
-
SHA256
022399fc4eed2289be4159f4ce1e7c268c72c01cad3c164c3b7f3f7c152d7588
-
SHA512
7dbcc2e78894abe96ee09510a7c605a531034b459a41907071efb818e29721b8603d4b26c1141b115c8b256d1cfdd06dd26e692bb8978cbe9fd239bb87a46866
-
SSDEEP
1536:fnnjAydSWV81vuLAjq4fDdpwFqo+s487Cu72vJcj:fjAyzU9LdpwFqmaBcj
Malware Config
Extracted
purecrypter
https://mahmoodonline.com/panel/uploads/Ebidr.wav
Signatures
-
Purecrypter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3848-7213-0x0000000005440000-0x0000000005450000-memory.dmp
Files
-
3848-7213-0x0000000005440000-0x0000000005450000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ