Behavioral task
behavioral1
Sample
9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b.exe
Resource
win10v2004-20231215-en
General
-
Target
9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b
-
Size
2.7MB
-
MD5
2c39e7af5ae71bbae52f7a77cf14cdba
-
SHA1
9fa99b8de52fd51a9e3c154249a1f021d1e80f8b
-
SHA256
9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b
-
SHA512
a87868b1b2d9ba3bf3258076fb6c8f995e6968902d59dfd0eb7ef9b62197b4c83f3feb089fb89133e0e9a0ef089ee0ee867d50509f4912464be41cd7b2d5bed4
-
SSDEEP
24576:qPsn9+gS6uHk1U4DHPeT97o+hzy3cHoORwqetii6hsuiWZJFN4IGy0:qELS6uH8UcGT9oHiohCd
Malware Config
Signatures
-
Detected Ploutus loader 1 IoCs
Processes:
resource yara_rule sample family_ploutus -
Ploutus family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b
Files
-
9f45dd6ded444bb7af801b51d61285b4d1f5190e55556c0aadc680f7e547e63b.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 175KB - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ