Behavioral task
behavioral1
Sample
3036-0-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
3036-0-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20231130-en
General
-
Target
3036-0-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
8cfd222cfce98e978ac1b1c3102805fa
-
SHA1
b1d57b5e067aee2e43d60be3c2a468c580f68955
-
SHA256
1877571ffe4f9b2a043178b55b5f67067f0653122546921cd10c5d67798e51d3
-
SHA512
3fb12b8d3ffc8a19e74f7ed596268a58268226176ff62de77c2982c6c79043505a38c05f1d22a795d85416f3ae7495a04b0f61d510076119ecf32ed9802c5d8a
-
SSDEEP
768:OkUqYDNiIoKpDd1KM02kQhx4hOtFceWzYqvz:zLiQLKtd1PBkQD4UtFceWnz
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3036-0-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
3036-0-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE