Behavioral task
behavioral1
Sample
4664-43-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4664-43-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
4664-43-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
14877314f47148733d0084e988d10f6f
-
SHA1
2c7d60e82851a964cf5f366b5bdf086848e8ea38
-
SHA256
3d24795ff7306dd34ef5a253b46f4164f0dc1274d2f31416bca49f9a72b775b5
-
SHA512
17e51a8d559dfa2c34c98dfa9b6f26b882740ab433e427c4e0206e18106ef4e38b70a3d9832324dfd80c87ad0fa1f859cf9f41697df10264b9f9b9fb54d89eb8
-
SSDEEP
384:K9VD6tee+O2UOTd2opQTR23a+Odz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRg:k6Qe+BUv83AcqdvOXA6XkPslJvGaVW
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 4664-43-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
4664-43-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE