Behavioral task
behavioral1
Sample
1924-54-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1924-54-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
1924-54-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
d30d7fe13539abd8f0f5f5581b046005
-
SHA1
73ffc63448015fd325fa86584c45ba15e8d5bfb1
-
SHA256
b681a24ebc33ed426b01c19956e150c7451b7ce71d96db7eebf7402a2d07ae36
-
SHA512
f38841589027d5cefb77d81eda82bfd1eb6539dd1c6a44b4664e0c1f5b23ddead505ca334c1b8049d54a9362a78c6baf54d62e7f267dd72288a97fa666f0c6f1
-
SSDEEP
768:OAUqYDNQIoKpDd1KM02kQhx4hOtFceWzYqvz:HLiWLKtd1PBkQD4UtFceWnz
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1924-54-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
1924-54-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE