Behavioral task
behavioral1
Sample
210d0660d201f6fb31423f2386a1be1e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
210d0660d201f6fb31423f2386a1be1e.exe
Resource
win10v2004-20231215-en
General
-
Target
210d0660d201f6fb31423f2386a1be1e
-
Size
5.1MB
-
MD5
210d0660d201f6fb31423f2386a1be1e
-
SHA1
132ddd7e3cd406df767a6aa18d38fbb044c09282
-
SHA256
28859da85f10b6a6aa1396b0593ec58f835dd491ed0b543cda8c046f80eb88d8
-
SHA512
06672a73e800f7c49a77df0a614a0ce4bd8c6bda6c5b746bc7cf6c931be987c72aa3fbf48fc4353c0e59ba762259f27ee0a71474e702f149ba3e1592d6d0a38c
-
SSDEEP
49152:QUPhClMsTt2RYZxGoLeC5XQXj2Pi15QO0rr3B9+OgRpUwXpUeXQq5dnQ:vCntYYCoLEx1/qK3pnZUeX15x
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 210d0660d201f6fb31423f2386a1be1e
Files
-
210d0660d201f6fb31423f2386a1be1e.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ