Behavioral task
behavioral1
Sample
2836-70-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
2836-70-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20231023-en
General
-
Target
2836-70-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
51ef1437c806f827fdc244dcfcf2f0da
-
SHA1
e8b5840aba7fd9f1ee028cc399a4f34991d2cb2c
-
SHA256
1adc59cc60ab31b9d479fee1e6766429fd23a0ec04c96746e2e30459260c2fc3
-
SHA512
8fbcc506af9658073f500677396a5a4a1690bd783f48a5918f3f48b6734f278a72e31334c88d08ea51fcc9b73e8dccb65ae16c07296168131d7c94f044a29e57
-
SSDEEP
384:K9VD6tee+qUOTd2gQTR23afdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYD:k6Qe+qUvg3IcqdvOXA6XkPslJvGaVW
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2836-70-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
2836-70-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE