Behavioral task
behavioral1
Sample
3348-78-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
3348-78-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
3348-78-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
9f1d332e489b26bdd03e24134de36c88
-
SHA1
78297566d5a6212a9c0ba3cce6fe3d2229d62f3b
-
SHA256
a5c6e6a506c7ab68fa0a6a41a331cb8595b544a09d5096bb93469c5690a99a24
-
SHA512
0eed2a6fd764f98bd2a7ef1f05dafce69398a7aa0c1605c168df9bb6855f1ce9e0c67ba505e24064991e0d6652bab5771e80e90f863e3f81216bd007f3848e3a
-
SSDEEP
384:K9VD6tee+O2UOTd2opQTR23ahfdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRg:k6Qe+BUv83KcqdvOXA6XkPslJvGaVW
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3348-78-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
3348-78-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE