Behavioral task
behavioral1
Sample
50747b50fef341943a992ab97539fbc0.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
50747b50fef341943a992ab97539fbc0.exe
Resource
win10v2004-20231215-en
General
-
Target
50747b50fef341943a992ab97539fbc0
-
Size
3.8MB
-
MD5
50747b50fef341943a992ab97539fbc0
-
SHA1
f6e4950849afdc5b27a1150c4809ed5b6789fe8c
-
SHA256
c2d230f9a73063fe5dfa2ba97d6bc4d174414aacaa56dbec03270cccf5509593
-
SHA512
eadea6e47884656488625888859da4a9d7cff4d1bafccf803c0cc67096db3e7100f386855ad708d78ba2f8d56c81540e5243507f4d77236fb4c278d5fbc81f90
-
SSDEEP
98304:F1mk/JHVU8MSoXtofz2gQ4J0+nlqQd2toEKatCIyEmrAWH24JNnzELvdr22KPldb:+oVUDDKFFJxwE2KPlfw0LUUK2vifG5Ei
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 50747b50fef341943a992ab97539fbc0
Files
-
50747b50fef341943a992ab97539fbc0.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ