HEUR-Trojan[.]MSIL[.]Agent[.]gen-fffc3cd304a280746276a3fa580a08f3de6aa2db4196c28ebd1c905607de0997[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

HEUR-Trojan.MSIL.Agent.gen-fffc3cd304a280746276a3fa580a08f3de6aa2db4196c28ebd1c905607de0997.exe
Size

555KB
MD5

2102422fdf58e1f1ea628e864576f437
SHA1

a071690fa220c12e9b5fa85e70dc3e7c42b30893
SHA256

fffc3cd304a280746276a3fa580a08f3de6aa2db4196c28ebd1c905607de0997
SHA512

9894a54a6c85ce3e087ef6f2a6da1a5744d71667eaa8f17d23985e15c39a425cfe53f838875573e828170ce6d3756618c4b293e3d81dfc7a7a5570daf2c0c2b6
SSDEEP

12288:gfp3lxis8EdrQso5hnyRIAPQJno5hnyRIAQg:gfp36sN5snUPjnUQg

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
sample	agile_net

Files

HEUR-Trojan.MSIL.Agent.gen-fffc3cd304a280746276a3fa580a08f3de6aa2db4196c28ebd1c905607de0997.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:01:5c:85:07:c3:9a:cf:c2:79:b7:00:00:00:00:01:5c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-07-2017 17:49

Not After

10-07-2018 17:49

Subject

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

37:7c:d6:0d:e3:2f:46:c8:0e:cd:04:d4:d4:07:4c:80:a2:e7:2c:dd:67:e3:15:44:24:cf:66:64:1b:5d:85:39
Signer

Actual PE Digest

37:7c:d6:0d:e3:2f:46:c8:0e:cd:04:d4:d4:07:4c:80:a2:e7:2c:dd:67:e3:15:44:24:cf:66:64:1b:5d:85:39

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

23-09-2022 10:11
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 519KB - Virtual size: 519KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:01:5c:85:07:c3:9a:cf:c2:79:b7:00:00:00:00:01:5cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

37:7c:d6:0d:e3:2f:46:c8:0e:cd:04:d4:d4:07:4c:80:a2:e7:2c:dd:67:e3:15:44:24:cf:66:64:1b:5d:85:39Signer

Signature Validations

Verification

23-09-2022 10:11 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 519KB - Virtual size: 519KB

.rsrc Size: 26KB - Virtual size: 25KB

.reloc Size: 512B - Virtual size: 12B

33:00:00:01:5c:85:07:c3:9a:cf:c2:79:b7:00:00:00:00:01:5c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

37:7c:d6:0d:e3:2f:46:c8:0e:cd:04:d4:d4:07:4c:80:a2:e7:2c:dd:67:e3:15:44:24:cf:66:64:1b:5d:85:39
Signer

23-09-2022 10:11
Valid: false

.text
Size: 519KB - Virtual size: 519KB

.rsrc
Size: 26KB - Virtual size: 25KB

.reloc
Size: 512B - Virtual size: 12B