DllMain
Static task
static1
Behavioral task
behavioral1
Sample
core.bat
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
core.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
fruit_32.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
fruit_32.dll
Resource
win10v2004-20241007-en
General
-
Target
3ff23f059a6349fc8c4db8dbf312aea52438e5eb9c085b30889666fc6f65b0e1
-
Size
420KB
-
MD5
f33f1ea34746fc446526c0a891e21ebc
-
SHA1
86418be5f019eb7952b3e17b4a9d59af54d56bb0
-
SHA256
3ff23f059a6349fc8c4db8dbf312aea52438e5eb9c085b30889666fc6f65b0e1
-
SHA512
de583642f19efb4f293400234ad7ee3580d1e0a5c3ca12f651fd55f203088ddb6057ca3ba9944d92c798035b350c7368bbd8560ada925a3279826039861000ff
-
SSDEEP
12288:1WYQ9HY96DaOgXV+xytrDtdGZMi1ypzuQ:AYhk+NXVltrDIn1w
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/fruit_32.tmp
Files
-
3ff23f059a6349fc8c4db8dbf312aea52438e5eb9c085b30889666fc6f65b0e1.zip
-
core.bat
-
fruit_32.tmp.dll windows:6 windows x64 arch:x64
6739a8e2099115036a82e0f2cc7f27a1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
GetOEMCP
GetCommandLineW
GetCurrentProcess
GetThreadErrorMode
GetUserDefaultLangID
GetUserDefaultUILanguage
FlushProcessWriteBuffers
GetLargePageMinimum
GetCurrentThreadId
UnregisterApplicationRecoveryCallback
IsSystemResumeAutomatic
GetSystemDefaultLangID
GetACP
GetCommandLineA
GetTickCount64
GetLastError
GetCurrentThread
GetCurrentProcessorNumber
GetErrorMode
UnregisterApplicationRestart
SetFileApisToOEM
GetTickCount
IsDebuggerPresent
GetLogicalDrives
GetSystemDefaultUILanguage
GetThreadLocale
GetThreadUILanguage
TlsAlloc
SwitchToThread
GetEnvironmentStringsW
AreFileApisANSI
VirtualAlloc
ExitProcess
WriteConsoleW
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
GetFileType
GetStdHandle
GetProcessHeap
LCMapStringW
VirtualProtect
FreeEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
IsValidCodePage
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
TerminateProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
user32
SetProcessDPIAware
GetProcessWindowStation
GetDesktopWindow
GetCursor
GetShellWindow
AnyPopup
GetMenuCheckMarkDimensions
CloseClipboard
GetKBCodePage
DestroyCaret
CreateMenu
GetMessageExtraInfo
GetFocus
GetClipboardViewer
GetOpenClipboardWindow
GetActiveWindow
InSendMessage
GetCapture
EmptyClipboard
CountClipboardFormats
IsProcessDPIAware
GetForegroundWindow
GetDialogBaseUnits
GetMessageTime
IsWow64Message
GetClipboardSequenceNumber
gdi32
GdiFlush
shell32
InitNetworkAddressControl
ole32
CoFreeUnusedLibraries
CoUninitialize
Exports
Exports
Sections
.text Size: 90KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
license.dat