Behavioral task
behavioral1
Sample
Ssbaopba.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Ssbaopba.exe
Resource
win10v2004-20230915-en
General
-
Target
Ssbaopba.exe
-
Size
28KB
-
MD5
aca05011fd930d7b5722fcfa9c2fa04c
-
SHA1
79eeea36e0578531fff48a1a5b11fbe3eae704de
-
SHA256
642a8d7b24f5c7726e96fdda14c3499f485cfc6e8110f888211890e21a3b20ed
-
SHA512
2d7c721833d202149b6f65a0550a3d742f534656821e8181fd67a8e732db8436b280ec95bca75d916d57b030d4f659cf8f812381ef7cdf84a2e7b7d496ae7bb6
-
SSDEEP
384:vOr53B+3v6juk9B51g8PxlKCDmmlMrfg:vw3DtXHpQo9Mrfg
Malware Config
Extracted
purecrypter
https://cdn.discordapp.com/attachments/1023901487681777749/1023903527459901460/Ssbaopba_Pjultaqh.jpg
Signatures
-
Purecrypter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Ssbaopba.exe
Files
-
Ssbaopba.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ