Behavioral task
behavioral1
Sample
PerX.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
PerX.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
WallHack_Rus_Version.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
WallHack_Rus_Version.dll
Resource
win10v2004-20231222-en
General
-
Target
9a9d87eddd0fa016941081f755aac4fa
-
Size
754KB
-
MD5
9a9d87eddd0fa016941081f755aac4fa
-
SHA1
f2dc9a760853b5590a0f0f7e251aee17e5b46c69
-
SHA256
eddfabddc124cc5911b05565b4a30dfc6c4bd749277f8a8cd32cae484b009b29
-
SHA512
69dfad33658313dfb94dfe9f5000e9d6c13b10437ee5d058f59f1a6705f0c0f99c7b8760e7cda0f5d3fd4f58a143644e198b93c0947ca0b25ca0fbc7b7dbae45
-
SSDEEP
12288:XVva7iLY3yxowJm0wIhM502jhOdm3xc4L24cVoS8c97WyP:XVCzyKwmoU0GhOdm3xXqP
Malware Config
Signatures
-
resource yara_rule static1/unpack001/PerX.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/PerX.exe unpack001/WallHack_Rus_Version.dll
Files
-
9a9d87eddd0fa016941081f755aac4fa.rar
-
PerX.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 452KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 169KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 92KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
WallHack_Rus_Version.dll.dll windows:4 windows x86 arch:x86
ce8ab431fbb2ecbc85250f5da649c004
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLocaleInfoW
MulDiv
CreateThread
Sleep
GetModuleHandleA
GetModuleFileNameA
SetEndOfFile
SetStdHandle
GetStringTypeW
LoadLibraryA
GetProcAddress
OutputDebugStringA
WriteFile
GetLastError
CreateFileA
WideCharToMultiByte
GetVersionExA
CloseHandle
GetSystemInfo
IsProcessorFeaturePresent
EnterCriticalSection
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
HeapAlloc
GetProcessHeap
HeapFree
VirtualFree
VirtualAlloc
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
SetLastError
FlushInstructionCache
GetCurrentProcess
RtlUnwind
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
RaiseException
HeapDestroy
HeapCreate
HeapReAlloc
IsBadWritePtr
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
HeapSize
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
LCMapStringA
LCMapStringW
ReadFile
SetFilePointer
GetCurrentProcessId
FlushFileBuffers
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
VirtualProtect
user32
GetAsyncKeyState
MessageBoxA
RegisterClassExA
GetDesktopWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
GetSystemMetrics
gdi32
SelectObject
SetTextColor
SetMapMode
CreateCompatibleDC
CreateDIBSection
DeleteObject
SetBkColor
SetTextAlign
DeleteDC
GetTextExtentPoint32A
ExtTextOutA
CreateFontA
GetDeviceCaps
d3d9
Direct3DCreate9
advapi32
RegQueryValueExA
RegOpenKeyA
RegCloseKey
Sections
.text Size: 328KB - Virtual size: 324KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 48KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: 4KB - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ