Behavioral task
behavioral1
Sample
93a09a5ecefc75e6fda23d83deffeffddf544da2103a75422e768d26cfe9ee7f.exe
Resource
win7-20240221-en
General
-
Target
93a09a5ecefc75e6fda23d83deffeffddf544da2103a75422e768d26cfe9ee7f.exe
-
Size
30KB
-
MD5
e3eaf28d0259c1b26429966c9b09a3cc
-
SHA1
b117999cc232f0faf9ff619dcabe34cea1f4d37e
-
SHA256
93a09a5ecefc75e6fda23d83deffeffddf544da2103a75422e768d26cfe9ee7f
-
SHA512
3aa82942d23f9c43810098798fa59fe2c31b0b471bcd1d29329049b2c1089bda018afa306b12f9505f378807d4191fd6780d71b8373bde0457281e36b6b48f3e
-
SSDEEP
384:ZpB+Sbj6NKsfv6ZRAHNqOL5qDYu7HPFGvDKNrCeJE3WNg3U7a6mdRXRen+PB+Qr3:ZDpsH6ZRwNPTuTPFs45NvGa+PWbj
Malware Config
Extracted
limerat
-
aes_key
123
-
antivm
false
-
c2_url
https://pastebin.com/raw/bQi0vNVC
-
delay
3
-
download_payload
false
-
install
true
-
install_name
pdf.exe
-
main_folder
AppData
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Signatures
-
Limerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 93a09a5ecefc75e6fda23d83deffeffddf544da2103a75422e768d26cfe9ee7f.exe
Files
-
93a09a5ecefc75e6fda23d83deffeffddf544da2103a75422e768d26cfe9ee7f.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ