Behavioral task
behavioral1
Sample
1184-95-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1184-95-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
1184-95-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
38c2c9fc97e350bc7b049fcfeb8336e0
-
SHA1
84a3740560e70207ce9933f4fd86a7c68b228411
-
SHA256
93fe70470394ac3a457f5487974db318f2849e9e0accfbf1b8184f54574a236b
-
SHA512
34a166745f227514d5a2c482298b0cfb288a4549f533e3da912cf2d9016b05be819e352d9b1a3f7dcf435295373189364d9b2345bf5db18514888221871006b8
-
SSDEEP
384:K9VD6tee+qUOTd2gQTR23a+dz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYD:k6Qe+qUvg3PcqdvOXA6XkPslJvGaVW
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1184-95-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
1184-95-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE