Behavioral task
behavioral1
Sample
Patch-Master PDF Editor 5.6.x.x.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Patch-Master PDF Editor 5.6.x.x.exe
Resource
win10v2004-20220812-en
General
-
Target
Patch-Master PDF Editor 5.6.x.x.exe
-
Size
495KB
-
MD5
5d8bb2f9f03c88f149f93c34c7e90ea4
-
SHA1
89cea38122ce3623ddb3c53835cffd37d3074d3e
-
SHA256
109ee2dffb22e1d66bdc8523d4839ad0509749dbf714a6681e096887d5d8bc19
-
SHA512
a0d78dd1ebd9a08b8dfecf42d2caaca2f052c512e058530bc9c7b7c2810f2f09be8870099107bdcd8981c57ffa3b7e89ec7b0c8ff7f91d079c26fce349433f50
-
SSDEEP
6144:f3IFhhBMzRC0U7PfJqOvi1pbmH6yX9Weaefet3Agp0q9ygbX+1RzDU8lI4QDrbB2:vI8ATxscH6yX9Z9saMJcR/V7
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net
Files
-
Patch-Master PDF Editor 5.6.x.x.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 338KB - Virtual size: 337KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 156KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ