Behavioral task
behavioral1
Sample
ac448a6412a2d9dfd4aeeecf1d0e1a3a75d28d064d9ae547838db5a0d109c7d6.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ac448a6412a2d9dfd4aeeecf1d0e1a3a75d28d064d9ae547838db5a0d109c7d6.exe
Resource
win10v2004-20230703-en
General
-
Target
3b18236d20f3fcdc6b73948643a03b13.bin
-
Size
27KB
-
MD5
8a493ab4ea4147abce7eeb51031b63ed
-
SHA1
b22c72a602f1f527266fc896fa87cb83ad2f7008
-
SHA256
a7cfb96f2cc19c306bfd336db77110271879c5a4489d454ef596366c9ffd2c89
-
SHA512
82ad7be64725a27ac9a068cb6bca707e302c26d9b985ae996aef9294ecc8ddbe1f594bdf79dcf2a5f8f7b91236561c2da5e7323b8f47cb8a9fd751bede01d052
-
SSDEEP
768:EmjukTaZbL6hvxYUaWF6jpXRPYLSLOsfGKnZ8:Em1TwwJVaWURl+SrOGZ8
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ac448a6412a2d9dfd4aeeecf1d0e1a3a75d28d064d9ae547838db5a0d109c7d6.exe
Files
-
3b18236d20f3fcdc6b73948643a03b13.bin.zip
Password: infected
-
ac448a6412a2d9dfd4aeeecf1d0e1a3a75d28d064d9ae547838db5a0d109c7d6.exe.exe windows x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE