Behavioral task
behavioral1
Sample
e03f7cbee9ba8443d200f1bcc47101185dcdc27b965b0ce9b650a0aae4c40492.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
e03f7cbee9ba8443d200f1bcc47101185dcdc27b965b0ce9b650a0aae4c40492.exe
Resource
win10v2004-20230703-en
General
-
Target
4feef1aae6a0fec7806c2c0fbbee297e.bin
-
Size
21KB
-
MD5
beda299e1773b91e7668ec1abcc98f2e
-
SHA1
5f4797865ed09f48d64354d9e6fb64025296506c
-
SHA256
937be586d53eda243ca697ffd24bbe2ddb51610f6d6e553e8eff31b09211166d
-
SHA512
fb12714ce85f3c6ff3aa8ca5322ff24b9db3a2a243b4eaa49bbdba4495d7da46c8bd4916c08d2df20cd11bd1848e77b906d89083d826c82351af61d2bb22bd44
-
SSDEEP
384:9yFUukSGF8j2hALq6/AUgA+atJSOyizeu4XzwbiQqY6e9u10hxQ:ExYFbhsXIUB+MMhJcqY6exxQ
Malware Config
Extracted
purecrypter
https://files.catbox.moe/730d8u.wav
Signatures
-
Purecrypter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/e03f7cbee9ba8443d200f1bcc47101185dcdc27b965b0ce9b650a0aae4c40492.exe
Files
-
4feef1aae6a0fec7806c2c0fbbee297e.bin.zip
Password: infected
-
e03f7cbee9ba8443d200f1bcc47101185dcdc27b965b0ce9b650a0aae4c40492.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ