Behavioral task
behavioral1
Sample
2416-0-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2416-0-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
2416-0-0x0000000000400000-0x000000000040B000-memory.dmp
-
Size
44KB
-
MD5
bce87be9852ddc15055a6561c8120004
-
SHA1
8bef1204fc0ebf0e8b3330dc702d7298440c0847
-
SHA256
d3c82fe32629d304eda578d3c285e091eb44304517a844fc5dbd6a9667587e17
-
SHA512
1126b903ac0bd3d48bfc873b81557895b518f06f17b940993216caa4948239299d25f57d65bc6e2a6b5fc84ac6474ff976e2d5706b87831b108d2fc8b707c4e1
-
SSDEEP
768:4riag0YrBHjJUrRhSZOh/q+wjDp8v3uWqeqLhy5:4riDD1HF+94jDS/XqeqVy5
Malware Config
Extracted
smokeloader
pub1
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2416-0-0x0000000000400000-0x000000000040B000-memory.dmp
Files
-
2416-0-0x0000000000400000-0x000000000040B000-memory.dmp.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE