Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe
Resource
win10v2004-20220812-en
General
-
Target
92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f
-
Size
1012KB
-
MD5
98d0000c28ed30d94374762113976b75
-
SHA1
60ceb509382e6309855d32cfcc99b34d782bd083
-
SHA256
92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f
-
SHA512
c1f3586a7b79c74de0b3ea7eb6d13c925d98655491ce043a9db56feef80c9b40e29f86b9e8d3e94328fc6c51722dc91e4e93b37beb15be97a4bbe8842f7ff1fa
-
SSDEEP
24576:2vzgO5yKsUaSuErRWNoEb0RkxFdtBNN57:zO5jGErsNrcc75
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net
Files
-
92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 944KB - Virtual size: 943KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ