Static task
static1
Behavioral task
behavioral1
Sample
201a75533e813778f5278f107505b384.exe
Resource
win7-en-20211208
General
-
Target
201a75533e813778f5278f107505b384
-
Size
279KB
-
MD5
201a75533e813778f5278f107505b384
-
SHA1
8523f543412b6f628011b748543f9de462229185
-
SHA256
0ebf44ed5f0614c08d4e5f25fb08cd33fa5ec7baa6a5c9c4c19d41dbf3e9df08
-
SHA512
f141453a0c6ca377a32dd764f74e2b2d66ac0db8f839636975b6e16cbb2c4305793a457adb296c7bbc93d6468bf3f0996b648618c7b2aa424a1df6f66f9cd2e9
-
SSDEEP
768:MMqwYNVrk9nVsWUtC4jECwcJvzsedMyIVQ4Cqz783rigpV+pxGxlkTnGnTP:MMPh9nl4HwcxzsedMyKQxqH6vqMP
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule sample agile_net
Files
-
201a75533e813778f5278f107505b384.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 253KB - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ