Behavioral task
behavioral1
Sample
99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
Resource
win10v2004-20240611-en
General
-
Target
99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
-
Size
6KB
-
MD5
1c56623199e1959f271a191d603360bf
-
SHA1
9a7429e8b08ef843739c7739e8a314006c20b2af
-
SHA256
99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a
-
SHA512
87c50fb8f13d5b0ce5d83d99e64a7728e466e33118faea4c52136dd8a2f70d5f4217c90f4cc3c415628b9f96b7ed114cedb2455e3edc1cc39e67a36b79fceee4
-
SSDEEP
96:QhN/c/kk91xUL9678Ms0wFFpBV4Xh4yvn1j4r/8iT85fTc70zNt:QhN/cx1o96hwFH4R4viRM+
Malware Config
Extracted
purecrypter
http://103.195.103.33/nf/Qtdxulkcon.wav
Signatures
-
Purecrypter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
Files
-
99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ