Behavioral task
behavioral1
Sample
2a6bc3b51d576a111847739da8f1039a8da4165d8dd6f6bf632af5c0f63e1a3c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2a6bc3b51d576a111847739da8f1039a8da4165d8dd6f6bf632af5c0f63e1a3c.exe
Resource
win10v2004-20221111-en
General
-
Target
2a6bc3b51d576a111847739da8f1039a8da4165d8dd6f6bf632af5c0f63e1a3c
-
Size
372KB
-
MD5
78622c7297396e174b4565304dc4ff55
-
SHA1
cf5609578478e80294e40e794bb5357ab7b7c89f
-
SHA256
2a6bc3b51d576a111847739da8f1039a8da4165d8dd6f6bf632af5c0f63e1a3c
-
SHA512
b50a00d9cc354914c75e17c482ec19a5c9a172e111af9455082ccb1a2e3e2e185f9262ab2dbf35b4378b547628d0002759b6054cfe2acb3f849944bbb4ffd78e
-
SSDEEP
6144:FYyYZYYgLkDHmfXwXsCaIMdXwqRuw8Ttcnyzv5+AeDkKr1UaIqLQy40u:FYyYTgamfylaI0wqRu7FwrBpIqt4L
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net
Files
-
2a6bc3b51d576a111847739da8f1039a8da4165d8dd6f6bf632af5c0f63e1a3c.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 211KB - Virtual size: 210KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ