Behavioral task
behavioral1
Sample
1708-0-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1708-0-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
1708-0-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
de5ed3c7b64912113b9e462b62ae6d2b
-
SHA1
86f4874d4346f60a44d03d0e5a1229bcbaa0fab6
-
SHA256
d1de419be1584107249419d920e386ece7a63fb849dbd9e66ee9f73612ae388b
-
SHA512
88093f99572d6efb7bb132421c587854be0d5d1f61332bb5c34018844c52edc76b47116cbcb2f1e8f0fb12172e6ed89d72387dc6a7109be4d554059366cc1fe5
-
SSDEEP
768:OAUoYtN3IoKpDd1KM02kQhx4hOtFceWzYqvz:H5EZLKtd1PBkQD4UtFceWnz
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1708-0-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
1708-0-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE