Behavioral task
behavioral1
Sample
test.exe
Resource
win10v2004-20230220-en
General
-
Target
test.exe
-
Size
72KB
-
MD5
ead0f66fb84fb045539d12fa406a972a
-
SHA1
68cb765c908355c299c0dde5efc52bebd52e8a6c
-
SHA256
83b701bdd5413ad1e33efc5ba844c8d0709312f826833783de50440bd3595287
-
SHA512
44cc79ecfe05c620839ca9f1c00498a093d15e661531bfbe83d3dac6ff30c233426fdddc9a11d6faee61ac6832e820d377d824cf545363cb2fc3144c9d3f699b
-
SSDEEP
1536:Q5dXTcKeACbORoAAtCqGbRbT6fVhOVAaY+2:Q59TKtORjoHKAdUZ2
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource test.exe
Files
-
test.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ