Behavioral task
behavioral1
Sample
3e015bb85b6ddefe308fe226f991feb0b399db981da66da1a6e0905d97338a5d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3e015bb85b6ddefe308fe226f991feb0b399db981da66da1a6e0905d97338a5d.exe
Resource
win10v2004-20221111-en
General
-
Target
3e015bb85b6ddefe308fe226f991feb0b399db981da66da1a6e0905d97338a5d
-
Size
159KB
-
MD5
9670247ade6428e86c0e2fd3c4ea1652
-
SHA1
018ca4049ed22aac3051b67fa1008db13b07b0c6
-
SHA256
3e015bb85b6ddefe308fe226f991feb0b399db981da66da1a6e0905d97338a5d
-
SHA512
e63cbd8bd7d0e5258bd44b9b2bcf21a642402b98778f6cd85a6bb70f29f02a019de5dcbf3f6c2a61405babf4e06dc94767708d9eae83e7280defc0bcd50168ff
-
SSDEEP
3072:Qd8hWKGPl+kLAdMWVfcuHxi4T8eaIMDyxgBHjZVqJ8TU:QdTfPBLQXVXHxi7IMmxolV3
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net
Files
-
3e015bb85b6ddefe308fe226f991feb0b399db981da66da1a6e0905d97338a5d.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 156KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ