Behavioral task
behavioral1
Sample
23e1d085f651b7995669a668d6492c0aba2d703b60691edd94f335caaba3a7b9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
23e1d085f651b7995669a668d6492c0aba2d703b60691edd94f335caaba3a7b9.exe
Resource
win10v2004-20220812-en
General
-
Target
23e1d085f651b7995669a668d6492c0aba2d703b60691edd94f335caaba3a7b9
-
Size
1.7MB
-
MD5
67346c79f9db3e769d66925ba37aa5ab
-
SHA1
781dc53e8bfeccf66a2c5e5191b9d99b08543c06
-
SHA256
23e1d085f651b7995669a668d6492c0aba2d703b60691edd94f335caaba3a7b9
-
SHA512
1e015c1c7989484c734d355237ce50bed6dae07617a0d64ed73629ac2b5163c8b797dc5d9d0b759501913c979421028d3a209af378031774219709134152e2dd
-
SSDEEP
24576:GHc7LCbe9qfvvc1YQjggGQoi47/icPyQpR75U7K/dPi8+Bb0O2YDr78VhUv3Z:GHYLClfyYMa7/j7DFqfB4NYb8cZ
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net
Files
-
23e1d085f651b7995669a668d6492c0aba2d703b60691edd94f335caaba3a7b9.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ