Behavioral task
behavioral1
Sample
1744-0-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
1744-0-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20231020-en
General
-
Target
1744-0-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
2a9823423e97c57fe66c527d39d17a78
-
SHA1
5a6df98a431c9d43872d4fa81d649e2e1efffa02
-
SHA256
1fda487b1d0dc687283618c5a9b260ddaa67ffdc4aa5ccd1a839479513c5017a
-
SHA512
0b59a09e7ff9bc7a38bb6fb8c189e1904bd4ba81735b07c8821040a335dcf42ff0cd475f0371819a204f4b2323a7c5523af22006dba66262c22082db0a57ab9b
-
SSDEEP
768:OkUqYDNoIoKpDd1KM02kQhx4hOtFceWzYqvz:zLiCLKtd1PBkQD4UtFceWnz
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1744-0-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
1744-0-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE