Behavioral task
behavioral1
Sample
dc714fd1acf06674aaaca07dd264452b27a4dc382838066a3e62c61066299daa.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dc714fd1acf06674aaaca07dd264452b27a4dc382838066a3e62c61066299daa.exe
Resource
win10v2004-20221111-en
General
-
Target
dc714fd1acf06674aaaca07dd264452b27a4dc382838066a3e62c61066299daa
-
Size
207KB
-
MD5
c7a127bebe08821f39a762477b2b873d
-
SHA1
9f5b0264cc5f1ce4e8899a0c06da74767398efc2
-
SHA256
dc714fd1acf06674aaaca07dd264452b27a4dc382838066a3e62c61066299daa
-
SHA512
89e64ea7485afd8160faf151fd3d2000193c444c60db220a0c546d2896cd69b9402cb2940952b1252212a24949bbab8a47e4e5e87a9a50ffd4b6863a466c6186
-
SSDEEP
3072:KAMrz/yDRzEJH68pZ6ySm+5Bb3EvMKwDU1LqyrIVuHZ4q:KAeryDR4JNWySm+5B5C1LXrIVs
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net
Files
-
dc714fd1acf06674aaaca07dd264452b27a4dc382838066a3e62c61066299daa.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ