Behavioral task
behavioral1
Sample
2444-0-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2444-0-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
2444-0-0x0000000000400000-0x000000000040B000-memory.dmp
-
Size
44KB
-
MD5
fd1303329164c6a7f851cb6647283d85
-
SHA1
2d3ab3193fd72cdf0765ba266f0b9d841bcbefe7
-
SHA256
f8716d170073289ee4413301679017dad9eb5de3ffea8743c8eff66ca1c8958d
-
SHA512
6db137ccc15a317ba79847bc74c7f7f383f9ed5531314eb68e59facc97a108f6c80024f5f9227ca9d440fa18143b672b8fa0a6e3962f4ebaac7dbc47a6707aa9
-
SSDEEP
768:4rikg0YrBHjJUrRhSZOh/q+wjDp8v3uWqeqLhy5:4ripD1HF+94jDS/XqeqVy5
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2444-0-0x0000000000400000-0x000000000040B000-memory.dmp
Files
-
2444-0-0x0000000000400000-0x000000000040B000-memory.dmp.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE