Behavioral task
behavioral1
Sample
2512-0-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2512-0-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
2512-0-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
ce4f2f532beeeb97e05d2b9d1a477ae5
-
SHA1
31a5179cf5a8e3feadb02802712398a9b2abed2c
-
SHA256
62ede797663d3413d47628ef5309be8573fd366c9679e9faf1e13ea2b312f8ed
-
SHA512
2e034bc767e2ad6075337bc44472c3ddd308b4964c8d0d501021e32aae2886e77c41c558beed6d07e6704697e089c42006a6ac30f1df635f5269fc1f3fd13659
-
SSDEEP
768:OkUqYDNCIoKpDd1KM02kQhx4hOtFceWzYqvz:zLi0LKtd1PBkQD4UtFceWnz
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2512-0-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
2512-0-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE