Behavioral task
behavioral1
Sample
194400x00000000004000000x0000000000409000memorydmp.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
194400x00000000004000000x0000000000409000memorydmp.exe
Resource
win10v2004-20231215-en
General
-
Target
194400x00000000004000000x0000000000409000memorydmp.exe
-
Size
36KB
-
MD5
ee3ff9b463168285fd69595f11134f51
-
SHA1
77f4248c1d4a0133d1e090eeafd1460d973acf72
-
SHA256
a152c721637666dc1e8861ddbe2f22a8db63a41fa9b3ca52dfbbb91f69c3fb80
-
SHA512
0f1d1436be4a335d43c4dd9cd1e9f87da6bcb862cd2c2cdc95892f88812e928f5cdd18291d42e4a7a250a55abf61cc4feb5a5f1640ba6767b007c846abf3ed97
-
SSDEEP
768:OkUqYDNdIoKpDd1KM02kQhx4hOtFceWzYqvz:zLiHLKtd1PBkQD4UtFceWnz
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 194400x00000000004000000x0000000000409000memorydmp.exe
Files
-
194400x00000000004000000x0000000000409000memorydmp.exe.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE