Static task
static1
Behavioral task
behavioral1
Sample
plushplr_w32.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
plushplr_w32.exe
Resource
win10v2004-20231020-en
General
-
Target
plushplr_w32.exe
-
Size
458KB
-
MD5
4c861d31603bf940a7deece3d7aab6f4
-
SHA1
f3f9aae5ad35b5298901136ed8be0a8529cc5d4c
-
SHA256
cd0417c7e3052c3095746abc136f79b21918fb3ee6c1e6feba703a47c291a7fc
-
SHA512
cf224612db4b7c657012adfa823f4b39295f6bb77f787259c93da67d3baff095308741f0ae553d315b177f8796c06354a761526d17ca2891ef26dac9f1b6077c
-
SSDEEP
12288:DxxijYqe41X9fFTRAUn5qn29uuV8ZV933pvrtJWqdj4SLO3GonmTyE0:ziArvWqdj4SLO3GonQyN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource plushplr_w32.exe
Files
-
plushplr_w32.exe.exe windows:5 windows x86
f4fc090d8beb90241b64ed203ba2c628
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
expat
XML_ParserCreate
XML_SetUserData
XML_SetElementHandler
XML_Parse
XML_GetErrorCode
XML_ErrorString
XML_GetCurrentLineNumber
XML_ParserFree
kernel32
GetLastError
WaitForSingleObject
GetModuleHandleA
CreateThread
CreateMutexA
InitializeCriticalSection
GetCurrentThread
DeleteCriticalSection
ExitThread
ExitProcess
SetStdHandle
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
ReleaseMutex
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetCurrentDirectoryA
GetCurrentDirectoryA
CreateFileA
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
HeapSize
SetFilePointer
ReadFile
IsValidCodePage
GetOEMCP
GetACP
CloseHandle
VirtualAlloc
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
Sleep
EnterCriticalSection
LeaveCriticalSection
SetEndOfFile
GetProcessHeap
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
GetLocaleInfoA
TerminateProcess
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
RaiseException
RtlUnwind
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
GetCommandLineA
WriteConsoleW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
HeapReAlloc
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
FindNextFileA
LCMapStringA
LCMapStringW
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
WriteFile
GetStdHandle
GetModuleFileNameA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
user32
GetKeyState
DefWindowProcA
ShowCursor
MessageBoxA
DestroyWindow
PostQuitMessage
BeginPaint
EndPaint
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
PostMessageA
GetForegroundWindow
LoadIconA
LoadCursorA
RegisterClassExA
AdjustWindowRect
SetWindowPos
GetDC
SetRect
FillRect
ReleaseDC
UpdateWindow
SetForegroundWindow
ShowWindow
InvalidateRect
SetCursorPos
GetSystemMetrics
gdi32
SetPixelV
DeleteDC
GetStockObject
CreateDIBSection
DeleteObject
CreateCompatibleDC
SelectObject
CreateSolidBrush
BitBlt
GdiFlush
SetDIBColorTable
GetPixel
Sections
.text Size: 372KB - Virtual size: 372KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ