Behavioral task
behavioral1
Sample
4160-1722-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4160-1722-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
4160-1722-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
0a8d783a3ee53604cc043be75fdd169b
-
SHA1
9aa3e835ca3894d46f5e8bc60de659f038c19aad
-
SHA256
d1c5f151e71ae83cf74ca22f6f2194f69cff355a53ad27e4d56776e49d533d54
-
SHA512
0280b25909cbd65e9b410f95545699f4de48c38de715ef4fe90570a9b5fe5cf499bbae970e64fc69558852f887c7560c1b73ad85be1a0ca32c630cfad2f1da7f
-
SSDEEP
768:I5W+OoJWR04fittwvNiJkBaIQMRzYauvtM6WA2:IitR0vttwuk4IPR+VM6W
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4160-1722-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
4160-1722-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE