Behavioral task
behavioral1
Sample
02a3d32c6a311ca0478e4767f3ea0eddf78cc44638200ca59c0a05bae42dca43.exe
Resource
win7-20230220-en
General
-
Target
02a3d32c6a311ca0478e4767f3ea0eddf78cc44638200ca59c0a05bae42dca43.zip
-
Size
10.4MB
-
MD5
81bd67017e1c005917685bb96f20a773
-
SHA1
8b6499c78324f7f8b6c740ca95302e29b85374a7
-
SHA256
333d2dcede1443de29aed954b66b8331fd8480ee1ca25adb530da698c3b14c08
-
SHA512
3335ecfee05f402fd0977fb3c27cc0d37bc750c7ab8de0a2086db89bcb1822f26152cad39d93ae9d0db44ee5d8715cd0ccaa09b228eb0afde7e5d5e4dfc8984b
-
SSDEEP
196608:PesvAUPGPBnZHh0KFX9QA5Y4kL8O/6emGBbM8ljEY8buGLFY:3IhZHh0KFNQ3fGexKY8buGLu
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule static1/unpack001/02a3d32c6a311ca0478e4767f3ea0eddf78cc44638200ca59c0a05bae42dca43.exe agile_net
Files
-
02a3d32c6a311ca0478e4767f3ea0eddf78cc44638200ca59c0a05bae42dca43.zip.zip
Password: infected
-
02a3d32c6a311ca0478e4767f3ea0eddf78cc44638200ca59c0a05bae42dca43.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 11.0MB - Virtual size: 11.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ