Behavioral task
behavioral1
Sample
fb44c3f7ca7e702a612b914b1350a96ee2bd9e3fbb35ee45032f8a8ee06b496c.exe
Resource
win7-20220812-en
General
-
Target
fb44c3f7ca7e702a612b914b1350a96ee2bd9e3fbb35ee45032f8a8ee06b496c
-
Size
440KB
-
MD5
9bf930bba26542e5658f52b4b35ebd90
-
SHA1
f9c11bfd8f8f81ddbde33cddfec12d816c2fdd24
-
SHA256
fb44c3f7ca7e702a612b914b1350a96ee2bd9e3fbb35ee45032f8a8ee06b496c
-
SHA512
f470bd3cf49777d6e8b9346fd42bc700d5d978e226e5b433fb33cd785cfd15e1ba9a40a3f7b520dab48b1f044194cd82e83259d09b38548a312a30a5d560aa9b
-
SSDEEP
6144:bZ4M9iqs8LArWW8z2088nltu4o/JnJ+5Nszq:t4MYqs8LArb8S0htu3S
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net
Files
-
fb44c3f7ca7e702a612b914b1350a96ee2bd9e3fbb35ee45032f8a8ee06b496c.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 188KB - Virtual size: 188KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 251KB - Virtual size: 250KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ