Behavioral task
behavioral1
Sample
0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025.exe
Resource
win10v2004-20231025-en
General
-
Target
0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025
-
Size
37KB
-
MD5
488acf3e6ba215edef77fd900e6eb33b
-
SHA1
8c52518f3e0208b8e1ba6174a988e2378d69fae0
-
SHA256
0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025
-
SHA512
a3b9cdbc5745f11e0ac1a4b722974c7ae9641d92eb8a2dace588de8f66f7fc56387526d0fd6bb04d682c840bdb3c067f69551ac3a84563fb165f3e3cebab039c
-
SSDEEP
768:icRUUxy0Lp3Ol0dcE+MgXnVKbjh9Gz64GolJMf6fYm:icJp3OwcEjqVKTGhGoliaYm
Malware Config
Signatures
-
Detected Ploutus loader 1 IoCs
Processes:
resource yara_rule sample family_ploutus -
Ploutus family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025
Files
-
0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ