Behavioral task
behavioral1
Sample
70cce5ab2fcc23f84d75333eb4b5986a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
70cce5ab2fcc23f84d75333eb4b5986a.exe
Resource
win10v2004-20231215-en
General
-
Target
70cce5ab2fcc23f84d75333eb4b5986a
-
Size
5.1MB
-
MD5
70cce5ab2fcc23f84d75333eb4b5986a
-
SHA1
8f98aea94726cc833e530407fe8d4d3bcf77455b
-
SHA256
56fbcb8ce4617354524d35e88a84d65b5dbd6e7beb331ba6de49e2796e9290a6
-
SHA512
98602c1ef8674b78c27363108a21d1d21386719d612a9f1f6cc53f1349f061878bdf048822aca4b5c136a283638208382b69f61a00f35f16c64cf11583c8d876
-
SSDEEP
98304:KYap3MQjKPSKPn0mjEMRoRheiRffzt9eWBmDDGgpDh4L4M:KYaFMQGPHPzEOcU4pcWBeqgjq4M
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 70cce5ab2fcc23f84d75333eb4b5986a
Files
-
70cce5ab2fcc23f84d75333eb4b5986a.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ