Behavioral task
behavioral1
Sample
1368-77-0x0000000000400000-0x000000000040E000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1368-77-0x0000000000400000-0x000000000040E000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1368-77-0x0000000000400000-0x000000000040E000-memory.dmp
-
Size
56KB
-
MD5
d23cf4ca908cd6abc649ec6cd84de17d
-
SHA1
ff7547681ff7a52634e362d52cae75378937dfa4
-
SHA256
396f39041a82b48dcb046c5885e0b6fa17509f0d393d177d99c83eff985cf58b
-
SHA512
3a43702bfaac11cec6c57fd82e043a05dc726b82bbf51336e69e321b1af2098352c9f3b574e13d23c12b914684b5985edccdd3bba87c994597eb51a09907a759
-
SSDEEP
1536:uyfCOL0/bFF+11/p3Arq4elRtc/fZmwcB3rYL:7fCOebg1lcqj+/fQwcB38L
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1368-77-0x0000000000400000-0x000000000040E000-memory.dmp
Files
-
1368-77-0x0000000000400000-0x000000000040E000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE