Behavioral task
behavioral1
Sample
e0a2c5eebb330fc9363f9cee85662ed12859b0df67aaa05c7ae998fe537a5c99.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e0a2c5eebb330fc9363f9cee85662ed12859b0df67aaa05c7ae998fe537a5c99.exe
Resource
win10v2004-20221111-en
General
-
Target
e0a2c5eebb330fc9363f9cee85662ed12859b0df67aaa05c7ae998fe537a5c99
-
Size
52KB
-
MD5
c6b617e2086dd035894bab55987b5de7
-
SHA1
c7c8bb0a4f36d664b92e5467f08b191291082c87
-
SHA256
e0a2c5eebb330fc9363f9cee85662ed12859b0df67aaa05c7ae998fe537a5c99
-
SHA512
51fe407a4a7fc4d535c8798ee0ddaccd1b32b1f0c6de0282d2c80a3225dcfec2e64ca41e74a915c2cb049308f896aa32a010a160411527f8bdb0f80f92ad0f74
-
SSDEEP
768:d4960z9OPbIyAYRk//fGMtQBGjA+OwytSEUb:d4Aq9OSGIfGxG9OH4b
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net
Files
-
e0a2c5eebb330fc9363f9cee85662ed12859b0df67aaa05c7ae998fe537a5c99.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ