Behavioral task
behavioral1
Sample
06765d8b2c9ddfd087b4bc2e7a571790.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
06765d8b2c9ddfd087b4bc2e7a571790.exe
Resource
win10v2004-20231215-en
General
-
Target
06765d8b2c9ddfd087b4bc2e7a571790
-
Size
263KB
-
MD5
06765d8b2c9ddfd087b4bc2e7a571790
-
SHA1
7b1bcce773de0b2aae92c577253ed6bf730293a2
-
SHA256
bf2c0d3fb00592aa32d20c76da71a307327e31ccaf55e4b045a2100fb29a9a88
-
SHA512
4d6efb8e678ef7f66595755f847c49d452e3fab6df6d9daf32c4789f4a4480b8e7ca950613030922ee4e3135a654a4237d2c4e0cb299b580750982e7175be6ec
-
SSDEEP
6144:asz84OCwhh6hLP+IAfet3Agp0q9ygbX+1RzDU8:No45m3saMJcR/V
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 06765d8b2c9ddfd087b4bc2e7a571790
Files
-
06765d8b2c9ddfd087b4bc2e7a571790.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 260KB - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ