Behavioral task
behavioral1
Sample
2844-89-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2844-89-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2844-89-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
5f57048e9f203e03425bdf2f784b7989
-
SHA1
29b24730b8325ef979b78c9eee77db7e576aa7e0
-
SHA256
8c07813c749e796865a44df79a2cade9993975aa11b1ab0966c511a916f25b02
-
SHA512
a2a8a021c14d4c95a050bb15704b40a3d2cf42fbf1c4cb5b741b20686af0a5edcf4c8861af0f1fec0014a336bd778e1d90a3f77c8c48781ae9c360e29c86e8d5
-
SSDEEP
384:K9VD6tee+qUOTd2opmTe9LIdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYD:k6Qe+qUv8mVcqdvOXA6XkPslJvGaVW
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2844-89-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
2844-89-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE