Behavioral task
behavioral1
Sample
7b7299437c564f295f20e689019b8b65a1c744568e94942329955bfc332dc598.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7b7299437c564f295f20e689019b8b65a1c744568e94942329955bfc332dc598.exe
Resource
win10v2004-20231215-en
General
-
Target
c278f346af1de6240f113f0c49565448.bin
-
Size
27KB
-
MD5
0325631551a8fd1013dca99561fd6a7e
-
SHA1
36f730614e6bb2cb61af7f1155d3e95b32d02892
-
SHA256
b43e4c45045fcd2f5ae827a7bcbdc54905807379cb670513822c1d48e70cd548
-
SHA512
ed7ed9164ac454ab22caf6d581b1465c9083bb7aba7f74f81542af1434cd0db1736a443798bf0552238da6f5308d458a7db1b54a00512919d41a84598b660951
-
SSDEEP
768:UBhEWvP+btKyr/gXp/BPRn1yLiW5KSLKalgK/LOzmrpfX:UkyctKyrWphRnCiW5jLJgWOCpfX
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/7b7299437c564f295f20e689019b8b65a1c744568e94942329955bfc332dc598.exe
Files
-
c278f346af1de6240f113f0c49565448.bin.zip
Password: infected
-
7b7299437c564f295f20e689019b8b65a1c744568e94942329955bfc332dc598.exe.exe windows:1 windows x86 arch:x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE