Behavioral task
behavioral1
Sample
2588-68-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
2588-68-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20231023-en
General
-
Target
2588-68-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
1ac64110cecb2f3c1299dd830869a784
-
SHA1
737226d482c63eeaff762a2334801dd54a843c58
-
SHA256
659911c91db727f176273937dc701e32cd0c2672eb573320a9ee708389bb83f7
-
SHA512
9bf22e3736e4d5713c3333537c913597867176e315fff1e3d149f1f4107518054b16ea5514072e8227dc638964f9285aaf3689642c7ad66c59e9561858dfa877
-
SSDEEP
768:k6Qe+BUv834PdcqdvOXA6XkPslJvGaVW:k6H+BUv88rvOXf9Je4
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2588-68-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
2588-68-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE