Behavioral task
behavioral1
Sample
3ed31d62ca1a55ed5154502486452c6a825eb95a913a2db780fbbd23c6bdf7e2.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3ed31d62ca1a55ed5154502486452c6a825eb95a913a2db780fbbd23c6bdf7e2.exe
Resource
win10v2004-20240704-en
General
-
Target
3ed31d62ca1a55ed5154502486452c6a825eb95a913a2db780fbbd23c6bdf7e2
-
Size
42KB
-
MD5
bb2fe2fc0e8fbe40ad8255f9b27498d8
-
SHA1
0b8f441d8a91de1a6ef25531e9b1889d29614095
-
SHA256
3ed31d62ca1a55ed5154502486452c6a825eb95a913a2db780fbbd23c6bdf7e2
-
SHA512
39aafbebe264a07565de9fc640cbdd88b483b848187a9b68b75a9798954c89b64359400f691499d8cfa2e2824fe20be833de4f28cdd3611212be8c328f2f646a
-
SSDEEP
768:DGIMl1ZpVAuwk+0JEmjoLWrU0y1oUz3wERUdocKXU6EXc7ZYLilzqKikl+mr7i0F:DrWZ0u6WK+U0y1v3w1+cqUx66mzqKikP
Malware Config
Extracted
purecrypter
https://erkasera.com/Yaki/Tcdtpyiqmak.wav
Signatures
-
Purecrypter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ed31d62ca1a55ed5154502486452c6a825eb95a913a2db780fbbd23c6bdf7e2
Files
-
3ed31d62ca1a55ed5154502486452c6a825eb95a913a2db780fbbd23c6bdf7e2.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ