Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20231215-en
General
-
Target
Loader.exe
-
Size
1.9MB
-
MD5
bc1f835b3e3c502c026dc61d6f5c3db0
-
SHA1
df96d7602cd12d75832482119d9c040daae5f10e
-
SHA256
ca3a9f8483929a9cff76010b1ec5996c0340e992ca38c06437e861fa8ed366b8
-
SHA512
f8fb76884e1877fb5a0164ecbc8a9c788a0c6574abed288da9fc216b4a5403787d45b68563a9f1a605f64d0c4b7b6a033c5c63e914736c5fd1feb33d43dd2951
-
SSDEEP
12288:UPTpYov387zqJUZQ4bvhe0LpN8e+KnpaIcOqCvE45D11FwhviWXp2f+p6:UP9038eLAqqO5D1ohviWXro
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
BJH;S Size: 209KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BJH;S Size: 209KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
hBAbavEw Size: 512B - Virtual size: 22B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.???? Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ