Behavioral task
behavioral1
Sample
1152-0-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1152-0-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
1152-0-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
bf7b5c63927da97e664ccc8b4fe9d0ba
-
SHA1
7573df847ff269ba289fb56cbd6080ad88f793eb
-
SHA256
edeb8442ba44d97a8bfc4e56b148c0b759a7c81bb612b739c74e83dcd7ddbc77
-
SHA512
2acb608fd6717739cd72ffec123bb15cb81e360be347118f4302fa51328149dc837ed0959ee6b7e68d57339fdb4f85a2fea34f966e861e99d708ed5ac7ef9009
-
SSDEEP
768:OkUqYDNhIoKpDd1KM02kQhx4hOtFceWzYqvz:zLiPLKtd1PBkQD4UtFceWnz
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1152-0-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
1152-0-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE