Behavioral task
behavioral1
Sample
7fd109532f1e49cf074be541df38e0ce190497847fdb5588767ca35b9620a6c2.exe
Resource
win7-20230831-en
General
-
Target
7fd109532f1e49cf074be541df38e0ce190497847fdb5588767ca35b9620a6c2
-
Size
196KB
-
MD5
e5957ccf597223d69d56ff50d810246b
-
SHA1
d41e96dedbe7c04439ba489535eb65d0c7b17674
-
SHA256
7fd109532f1e49cf074be541df38e0ce190497847fdb5588767ca35b9620a6c2
-
SHA512
0025c7dcb8f15fca34644265ef61c46abdec9f3a5403de84660fd9b75d55834d4b0c4ea2e37293ec81ed52da58dab6fcecbc8b19cad91b71b6a00a7c79f5fa00
-
SSDEEP
6144:LqFG9CcmjzJPsvnlHd4sshj8WujTqsHG3:LkG+JMnZCTpym
Malware Config
Signatures
-
Detected Ploutus loader 1 IoCs
Processes:
resource yara_rule sample family_ploutus -
Ploutus family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 7fd109532f1e49cf074be541df38e0ce190497847fdb5588767ca35b9620a6c2
Files
-
7fd109532f1e49cf074be541df38e0ce190497847fdb5588767ca35b9620a6c2.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 192KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 1024B - Virtual size: 744B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ