Behavioral task
behavioral1
Sample
4504-1-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4504-1-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
4504-1-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
c3a59bd85776a7914d0268efe8e356c7
-
SHA1
28c8bcb5f0c5bfc8b3e781aff20bf7aa43998d6b
-
SHA256
d3ac53a10256bdddb286aa1a5506f946c2c19b751bff652448ac70904733a809
-
SHA512
866263394fccde8eae0e1f355385655a8bd09c1f7712990318b0045363ee986fab3ba49aa379bc4f0ecca37d8eec7f30d9e1db2f9212c3500f48ded150c0a8cd
-
SSDEEP
384:K9VD6tee+qUOTd2opGIVXLDdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYD:k6Qe+qUv83cqdvOXA6XkPslJvGaVW
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4504-1-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
4504-1-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE