Behavioral task
behavioral1
Sample
556-84-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
556-84-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
556-84-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
553ce0f16ed6e667f5e7d82b311922da
-
SHA1
eb8e05656d049c8d8652d92e0697774d064ec948
-
SHA256
b533107a2b608dfb60c7daa1aac12cd1b8d9c33f7a6aafecf835b16169fc7806
-
SHA512
93dab1f8d6b54c79e982c5d4d9396fcd6d308246d54f0225b5e234b77a8233968e79699f2a9a772298b6c382fa070dae441e4a9ce404e0d9186426fd495795d7
-
SSDEEP
384:K9VD6tee+qUO7d2opQYiLLsdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYD:k6Qe+qUX8P7cqdvOXA6XkPslJvGaVW
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 556-84-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
556-84-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE