Behavioral task
behavioral1
Sample
816640f101b9440dc8892bf84720ac50afe8fe11888574fa8b81af8caae19aa7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
816640f101b9440dc8892bf84720ac50afe8fe11888574fa8b81af8caae19aa7.exe
Resource
win10v2004-20231215-en
General
-
Target
b6495a9c6a890740db6f41bf37af8427.bin
-
Size
27KB
-
MD5
f8dec2a4457c44910844eef8f8eb3f2d
-
SHA1
8f2da1c5dfdac21ed0734bac0a83bfd71d2361bf
-
SHA256
750541e3c02cdea8ed3796f5d16bf1ed748597433f6ac1d8cec02ee0392b13ec
-
SHA512
13f807e4391b8e7d31023c2ecc48026287381d8e9a20d145383c32ad69b346dea8a3966818f1133fa240eae957816a6db03f3cd63ad71da7adbcf57d30c87652
-
SSDEEP
768:XHrCwyhFMKf/vHXbO+M+KsAbGRdRsm2epLWjyKflPLdhJ+X:XHuwyhG6HXb5fGGRdzdWjys5hJ+X
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/816640f101b9440dc8892bf84720ac50afe8fe11888574fa8b81af8caae19aa7.exe
Files
-
b6495a9c6a890740db6f41bf37af8427.bin.zip
Password: infected
-
816640f101b9440dc8892bf84720ac50afe8fe11888574fa8b81af8caae19aa7.exe.exe windows:1 windows x86 arch:x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE