Behavioral task
behavioral1
Sample
d236509fb50fc5f03c05e2a3e2872379e9611e32368f6d634a58c1b95cedec1a.exe
Resource
win7-20220812-en
General
-
Target
d236509fb50fc5f03c05e2a3e2872379e9611e32368f6d634a58c1b95cedec1a
-
Size
140KB
-
MD5
53990f098189852716b050a868141295
-
SHA1
229d3e37685b4a101a379a44e4783387222fc2ce
-
SHA256
d236509fb50fc5f03c05e2a3e2872379e9611e32368f6d634a58c1b95cedec1a
-
SHA512
3d4bd46b0f057892ec8ffada132b9f469efd751b265235ff4a62a51ef43a1c46ba7a150aae841740756925c3c424c6a0abe96d59552ff48951838b85091d6c9a
-
SSDEEP
1536:F/v1zMrcKhuRfBTR7sMlO+0MR8pPGS0Fe0WZmLSJcbRxoLfdiP7SaIjDqX3acZrE:51zMrcR5TaMIrxZmLSJtl6+aIm3j8
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net
Files
-
d236509fb50fc5f03c05e2a3e2872379e9611e32368f6d634a58c1b95cedec1a.exe windows x64
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ