Behavioral task
behavioral1
Sample
Payment_Confirmation_230721pdf.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Payment_Confirmation_230721pdf.exe
Resource
win10v2004-20230703-en
General
-
Target
c166be4fd3b26883ae35f7f1d8b51459.bin
-
Size
22KB
-
MD5
910c8feb8241e376c2d4c87903a3dfd7
-
SHA1
d91feb998124c5259f98c501bf6787a76e739376
-
SHA256
cf4ae5098d68cacdc792f21502212cff6f9e543682580b722b05fa90d30d5620
-
SHA512
f757be97f818597b672d2e408d24967f1593b51a6e537f0287594669390c87b44b6247e5713f96f198caecb2f8dd5bfde99fb2c311989a952d3e4f3b815f3e49
-
SSDEEP
384:uObgd7h9lE4n+3gQaRej1o3zbH5tTcP7EbHouwOacDrSXjybmRx7gcnmf1r5rDFd:uObg7ERWN3rcjKIuwOjyj7Rmf1rhDW3w
Malware Config
Extracted
purecrypter
https://files.catbox.moe/730d8u.wav
Signatures
-
Purecrypter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Payment_Confirmation_230721pdf.exe
Files
-
c166be4fd3b26883ae35f7f1d8b51459.bin.zip
Password: infected
-
1a4760e0f9e6c603749c0df65f48bfccc5a76476ed44b61dc0ea57cadb21a9e6.img.iso
Password: infected
-
Payment_Confirmation_230721pdf.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ