Behavioral task
behavioral1
Sample
84f65866aaa28ee56b5fa677a7199e432ac72b15f9328bbbbdc04998507c59ce.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
84f65866aaa28ee56b5fa677a7199e432ac72b15f9328bbbbdc04998507c59ce.exe
Resource
win10v2004-20220901-en
General
-
Target
84f65866aaa28ee56b5fa677a7199e432ac72b15f9328bbbbdc04998507c59ce
-
Size
388KB
-
MD5
46ff14c37635a25c19370219ed2a9a9b
-
SHA1
cb58febfef7e00a074e28c5dd89400917afc8ab3
-
SHA256
84f65866aaa28ee56b5fa677a7199e432ac72b15f9328bbbbdc04998507c59ce
-
SHA512
b47e7e038c5a46611f8587fa713b300a34afff41aa117bf96d181f0482cca3be815dc729be5e39480cb6397fa08b59640edfcff9b53f574c4fc5e0730067bc10
-
SSDEEP
6144:U6Nj5tp1n5R4KMpfsp95jIgLkDHmfXwXsCaIMdXwqRuw8Ttcnyzv5+AeDknmOF:Uwb7P4XfyjIgamfylaI0wqRu7Fwr8X
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net
Files
-
84f65866aaa28ee56b5fa677a7199e432ac72b15f9328bbbbdc04998507c59ce.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 357KB - Virtual size: 357KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ