Behavioral task
behavioral1
Sample
2732-27-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2732-27-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2732-27-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
7c2be2c3d2c93f20458c0db985d497f3
-
SHA1
0c41d1c06032f7b08e1a7690d5df48e7a1a06b3e
-
SHA256
e2d6c7742e604c1aa50734e8fd87adad56b91b65b6de7e25ef7e498544cc5bb5
-
SHA512
99f2c3aac3004604b677ac88d784dc633d7d037bd62f1e4bbcc5fbe8cbbfffbfc1bafe81e3da8d1d8e98b59a9dbf8bb4902d9a476cdeae40ce6c2dd27d43312f
-
SSDEEP
384:K9VD6tee+qUOTd2opmTe9L4dz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYD:k6Qe+qUv8mlcqdvOXA6XkPslJvGaVW
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2732-27-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
2732-27-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE