Behavioral task
behavioral1
Sample
2612-47-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2612-47-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2612-47-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
559a63063f04c4eac7315ce519647916
-
SHA1
a92e5306d53d57155548a16469a513a9a0cce37d
-
SHA256
e3c39eca8483312d9611f4e0b61f5669605c42a2bb0c79fdca6677bc8a88d736
-
SHA512
395af966e0b6c48d807efe8fd1459d37e71e57ed0254343ee81fae318f3bee56ed19a55963b8727b28fb58ed7a984d4bcca80d20817b82838c8e3fb17c384e7b
-
SSDEEP
384:K9VD6tee+qUOTd2opmTe9Lcdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYD:k6Qe+qUv8mhcqdvOXA6XkPslJvGaVW
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2612-47-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
2612-47-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE