Behavioral task
behavioral1
Sample
orden de compra 211123_Arvilab srl.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
orden de compra 211123_Arvilab srl.exe
Resource
win10v2004-20231020-en
General
-
Target
64548b61203f7f11ef1aef667fe19bbab564f43a62abdf0ddd89d5330a298d54
-
Size
112KB
-
MD5
f9ec01d302011f81bdeb43d28169b3b7
-
SHA1
833d20e6c08f67c3b9541dc1d6c11d754aa6cb78
-
SHA256
64548b61203f7f11ef1aef667fe19bbab564f43a62abdf0ddd89d5330a298d54
-
SHA512
18a889a567fba87ab41c16844d1f3a1882165665fdb031c83963e298346c7e3850b3878db1a59ea799454c189eeafb1916783cddf9c888cf7bfda12d9207ce12
-
SSDEEP
384:TarebUqIH2VIGJfZf0iTbZ0yITJOHOfHgNN0G+37Zvj66QnzVcTaOidKjWPe9qbu:T3/p0IETJOHOfHgNNU766QYaOiz
Malware Config
Extracted
purecrypter
https://onedrive.live.com/download?resid=F6CFB1B6019B1562%21264&authkey=!AHGHtUCYkGXio4k&em=2
Signatures
-
Purecrypter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/orden de compra 211123_Arvilab srl.exe
Files
-
64548b61203f7f11ef1aef667fe19bbab564f43a62abdf0ddd89d5330a298d54.iso
-
orden de compra 211123_Arvilab srl.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ