Behavioral task
behavioral1
Sample
1868-114-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1868-114-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
1868-114-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
d3ac15b11a4b03c146549e4e5d5a81f9
-
SHA1
d5edc891d51168c1a5d3d5f44f26fe38d8ed5629
-
SHA256
7743b88b1f136dee9ac2c6ab894ac5fbea451f6a2e1faa7d2471c93f9c42e187
-
SHA512
29b8822cb5ee9ad6223e5995250316ad70bc61ce1eff30a53c7c5c34a0242dce870e70f4b5ee66f6209140625eb4db9c86280d0835683889f1df115864b5f72f
-
SSDEEP
384:K9VD6tee+O2UOTd2opQTR23aIdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMV:k6Qe+BUv83lcqdvOXA6XkPslJvGaVW
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1868-114-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
1868-114-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE