Behavioral task
behavioral1
Sample
Bestellung+BEE-22201200_pdf+++++++++++++++++++++++++++++++++++++++++++++++.iso
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Bestellung+BEE-22201200_pdf+++++++++++++++++++++++++++++++++++++++++++++++.iso
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
out.iso
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
out.iso
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
Bestellung BEE-22201200_pdf .exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Bestellung BEE-22201200_pdf .exe
Resource
win10v2004-20231222-en
General
-
Target
Bestellung+BEE-22201200_pdf+++++++++++++++++++++++++++++++++++++++++++++++.img
-
Size
104KB
-
MD5
cdfb2162885d92ca5fd2c8c1a3c79705
-
SHA1
fefdeecc76163884124c070bf0f0fea9c027354f
-
SHA256
95f3bf41ab43a29221a702337ffd53a3974b628aa6c5eccd37a4cf3d79732740
-
SHA512
b7a48d32285305024414561bef69011e0a287b8f11c7b0fd12a469fe9cfd63abef424f922a360a0e66604669740a224c71011e94bd2ced0de000280ebd06d6be
-
SSDEEP
96:5ReBVCIzP+eImTgo70FlDiC5ZUo4ossr9r4GvgsKC5Ys0X+zNt:gVCcPjTgJhYo4orprW7o0XY
Malware Config
Extracted
purecrypter
http://103.183.118.30/THANOS/Uhjbks.mp4
Signatures
-
Purecrypter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Bestellung BEE-22201200_pdf .exe
Files
-
Bestellung+BEE-22201200_pdf+++++++++++++++++++++++++++++++++++++++++++++++.img.iso
-
out.iso.iso
-
Bestellung BEE-22201200_pdf .exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ