08d7e643d166d47fa798c5fc4ab1f08d9bc7c9294a74eb792add487dae8e192e[.]exe[.]zip

General

Target

08d7e643d166d47fa798c5fc4ab1f08d9bc7c9294a74eb792add487dae8e192e.exe.zip
Size

16.8MB
MD5

c13b5aeadade25e1244e5d6ebfb836eb
SHA1

db97c5602b716620840f2b1a048f57dd6b8004a1
SHA256

c1a7e2e8a57056cd7c59e91a49eca2b7a1b78f9d9f2391210a1f75f2956bb1dd
SHA512

0fcdf7dd4a5dcd133c6c9c3e18faa7d1a6ed183fd89e77e40018ad2b533a0c255594ce690a04f5538dad53a57ddb159a94be9ec54d05fbc94b038476a2f5c494
SSDEEP

393216:F9wgBUWpRtcxuNzqrOQqZEmV1wXtC2XTwrPjOW82DZ:FGoUW+YBqrWGmUXgiwPLDZ

Score

7^/10

agilenet

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

resource	yara_rule
static1/unpack001/08d7e643d166d47fa798c5fc4ab1f08d9bc7c9294a74eb792add487dae8e192e.exe	agile_net

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/08d7e643d166d47fa798c5fc4ab1f08d9bc7c9294a74eb792add487dae8e192e.exe

08d7e643d166d47fa798c5fc4ab1f08d9bc7c9294a74eb792add487dae8e192e.exe.zip
.zip

Password: infected
08d7e643d166d47fa798c5fc4ab1f08d9bc7c9294a74eb792add487dae8e192e.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 21.4MB - Virtual size: 21.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ