Behavioral task
behavioral1
Sample
537ce0980092ed4011fd4b75ca4553f185523b2d944f63b1196f7bf5dd103315.exe
Resource
win7-20220812-en
General
-
Target
537ce0980092ed4011fd4b75ca4553f185523b2d944f63b1196f7bf5dd103315
-
Size
828KB
-
MD5
7288d0e188fd54caab6f6cfa0f7acaa4
-
SHA1
1b3265fd2d486973ff0164507a92de3fd9bdca99
-
SHA256
537ce0980092ed4011fd4b75ca4553f185523b2d944f63b1196f7bf5dd103315
-
SHA512
d32469dc5b26e9c40fb43e27d0b2f87891cc57c7498fe03d8512ab4c87d415dadfea4e6f1351b58e2d23444545a53b34d75d328fc332f0eee477cada8418cf97
-
SSDEEP
12288:2R7OwrGIcaP4Se9rMKbT5tjkscNZR2F8wLEOzRgTZtsDQmsjfe:e6IHvgTHCaFfLntwsDQmsje
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net
Files
-
537ce0980092ed4011fd4b75ca4553f185523b2d944f63b1196f7bf5dd103315.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 760KB - Virtual size: 759KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ