Behavioral task
behavioral1
Sample
780-52-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
780-52-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20231020-en
General
-
Target
780-52-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
828023388e81e36b55b4a3de6aebcb5a
-
SHA1
74393ae88da7bbfc58bef236c21688788be55c70
-
SHA256
d1a8e8c8dcd2bd97bdf4d4152c2a0e11f7381e26808b471add38ed92a4ca0fb0
-
SHA512
88bc89b182433b15449b0f5474f9f13fff82ffcb2e446f40670a626f5df721eea034328707fe4e5a723f137005a80e122c86f0ab987b1feac000b4c5763d5f19
-
SSDEEP
384:K9VD6tee+O2UOTd2opQTR23aXFdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRg:k6Qe+BUv834vcqdvOXA6XkPslJvGaVW
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 780-52-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
780-52-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE