Behavioral task
behavioral1
Sample
50420ce8cebac5253b18d90af2858e81.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
50420ce8cebac5253b18d90af2858e81.exe
Resource
win10v2004-20231215-en
General
-
Target
50420ce8cebac5253b18d90af2858e81
-
Size
6.2MB
-
MD5
50420ce8cebac5253b18d90af2858e81
-
SHA1
f2415c097b8804c80484c812c272766a95d9700f
-
SHA256
bf923893a7af6f3f3546b0805b2478e61c5e167f74a80c13174a3d5341c346b2
-
SHA512
e673e1bcd0a6aebbe29c06f60e8635bd012ec80b619654041c7f1d235aa36405af86cae16bf1242dffff6e86a197df4812ca86c9c81478a9be305ac5849758e2
-
SSDEEP
196608:ebV8ld98BlON2jnbNswvBXvowJgzl7GSZn7ftmo:L90jVvBXvoww77rco
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 50420ce8cebac5253b18d90af2858e81
Files
-
50420ce8cebac5253b18d90af2858e81.exe windows:4 windows x64 arch:x64
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ