Behavioral task
behavioral1
Sample
1fe6ca4f2864852e7f2436b13b70092802cbe67fa06d118eccf34b1555825ac5.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1fe6ca4f2864852e7f2436b13b70092802cbe67fa06d118eccf34b1555825ac5.exe
Resource
win10v2004-20230703-en
General
-
Target
5a41bbace914d9256ca4a89d720d0952.bin
-
Size
27KB
-
MD5
082a4c16597b67c7dc08dd4e0a594c66
-
SHA1
2f0b87a8801795e752beca79f4539c71598116d3
-
SHA256
1f3328d938351194eb59014d7bce5a4f655f6ed265b045d128fbffbe0dc81508
-
SHA512
6ed211b9e048461763f6bc042ba2f1c7b4e238149797c0277370bffdc3af3438d90f4ff809f971ea5d67a1b118ac6b85f97e22c184f814e2028fabd7373868da
-
SSDEEP
384:8IWu1OAdtZg3+4GJhkcw0prDPcuhjDQpX3VFfFvlJ6V8dhWNRL0FoZFgtYZv5OyQ:RMAdPzVQg1DUuh/Ufp6V8d4r1ZF94DRh
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/1fe6ca4f2864852e7f2436b13b70092802cbe67fa06d118eccf34b1555825ac5.exe
Files
-
5a41bbace914d9256ca4a89d720d0952.bin.zip
Password: infected
-
1fe6ca4f2864852e7f2436b13b70092802cbe67fa06d118eccf34b1555825ac5.exe.exe windows x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE