08d7e643d166d47fa798c5fc4ab1f08d9bc7c9294a74eb792add487dae8e192e[.]exe[.]zip

General

Target

08d7e643d166d47fa798c5fc4ab1f08d9bc7c9294a74eb792add487dae8e192e.exe.zip
Size

16.8MB
MD5

156e907ec11b125b1e5e6708bec5e989
SHA1

d1f6859e17f17c50bf4e8dc2f94a2227d15f66ca
SHA256

d26bff177d06e26765a00d4da29d3de8767ac7565be838e4d34e9c35abde3969
SHA512

650db70b02439a1b4a3be4dd3784dcf6a6e965ecffc3a220f2c9f827f097f8be9138a155e4d5f0ae8081e12f6e42ed8726d530599dc99135b4bc4db46a6be7bf
SSDEEP

393216:UaK4Pcqrjw3Q4jjcJaFxpogaPAnXZzN7nBi8os0h9:UQbrb43cJaFxqgaPAnXvnEh9

Score

7^/10

agilenet

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

resource	yara_rule
static1/unpack001/08d7e643d166d47fa798c5fc4ab1f08d9bc7c9294a74eb792add487dae8e192e.exe	agile_net

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/08d7e643d166d47fa798c5fc4ab1f08d9bc7c9294a74eb792add487dae8e192e.exe

08d7e643d166d47fa798c5fc4ab1f08d9bc7c9294a74eb792add487dae8e192e.exe.zip
.zip

Password: infected
08d7e643d166d47fa798c5fc4ab1f08d9bc7c9294a74eb792add487dae8e192e.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 21.4MB - Virtual size: 21.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ