Behavioral task
behavioral1
Sample
2120-0-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
2120-0-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20231127-en
General
-
Target
2120-0-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
0bd2c3a08bb6aa8d7be680bd3a44be9f
-
SHA1
8f78aeacbcd6f07a1f3890da106ded1e387d337d
-
SHA256
3edc03e104e8baaf0a0eb89c47b7bde5441e2e71650f9ada54ef81e0b804c810
-
SHA512
743f29caa30273caaf97c3de0b1c7617232a32351338a28b28578019600d538b8c95a299f887f9a4a2ede39548dc8e5f44d4b049314ef8c04ceb1c18db5087ba
-
SSDEEP
768:OkUqYDNvIoKpDd1KM02kQhx4hOtFceWzYqvz:zLiFLKtd1PBkQD4UtFceWnz
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2120-0-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
2120-0-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE