Behavioral task
behavioral1
Sample
9738b549babd3da2ea9c95315a1fa1d0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9738b549babd3da2ea9c95315a1fa1d0.exe
Resource
win10v2004-20231222-en
General
-
Target
9738b549babd3da2ea9c95315a1fa1d0
-
Size
299KB
-
MD5
9738b549babd3da2ea9c95315a1fa1d0
-
SHA1
30b47667463940e0ef8eec92b2cd10046da26945
-
SHA256
826d8c11ad852d2864a4d7908c7df332a79f3216b5d77527b65438b419251ccb
-
SHA512
4caa171ca7548a5039610f2d6351266b73e08f7238d49abc701c3c596ee632566ceb85c237d08dd7b1247104399ca7f7f13feb332fe32b9b3dc78f4ea8570a83
-
SSDEEP
3072:2c8hUR3NM90FfXhkjhbNIXeea8qhdhmeK5+U2Y6QcsM/jb5Yideel:2U3O90Ff+j8XejdQvABn3/jb+i
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9738b549babd3da2ea9c95315a1fa1d0
Files
-
9738b549babd3da2ea9c95315a1fa1d0.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 297KB - Virtual size: 296KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 584B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ