Behavioral task
behavioral1
Sample
00861d86dbe7b3a63e12fd5096341c3b221d3bfbc535a9b2f88d81a4ef9539ff.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
00861d86dbe7b3a63e12fd5096341c3b221d3bfbc535a9b2f88d81a4ef9539ff.exe
Resource
win10v2004-20240508-en
General
-
Target
00861d86dbe7b3a63e12fd5096341c3b221d3bfbc535a9b2f88d81a4ef9539ff
-
Size
617KB
-
MD5
64d45cbe65ea37bb1de2a71f36af151e
-
SHA1
9d1e38e66821e7b12a1ff1730885f71373e373f9
-
SHA256
00861d86dbe7b3a63e12fd5096341c3b221d3bfbc535a9b2f88d81a4ef9539ff
-
SHA512
48857068e714f6f22d83b601a19219669aa58ecf691001a54f06a38074281053ea0780d05557cae22ea7112e71ceab832f8bffe991d1d198192ac11e6e46b8d3
-
SSDEEP
6144:WtTB9eOWnaWYkq1VN7BxDrU9J+klKnevBHrhpTrkt52E1qXSBzkk4L3CmmoTyzW9:WtTGOoaW+nGlKevBU1qhk4z0ayzW4yz
Malware Config
Signatures
-
resource yara_rule sample purplefox_rootkit -
Purplefox family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 00861d86dbe7b3a63e12fd5096341c3b221d3bfbc535a9b2f88d81a4ef9539ff
Files
-
00861d86dbe7b3a63e12fd5096341c3b221d3bfbc535a9b2f88d81a4ef9539ff.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 800KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 564KB - Virtual size: 564KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 52KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE