D:\Mirserver\Mir200\Secured\Clinet\Client.pdb
Behavioral task
behavioral1
Sample
ad69f690a5783c1b6079bebc86b4ca6691166de2b68cfbdf7aa35e9285833d7f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ad69f690a5783c1b6079bebc86b4ca6691166de2b68cfbdf7aa35e9285833d7f.exe
Resource
win10v2004-20240220-en
General
-
Target
ad69f690a5783c1b6079bebc86b4ca6691166de2b68cfbdf7aa35e9285833d7f
-
Size
3.1MB
-
MD5
6ece7110e35c87cf7f9d2a146b109139
-
SHA1
867f6ce62b0d7d387b4e93b31ccd16b89f380b90
-
SHA256
ad69f690a5783c1b6079bebc86b4ca6691166de2b68cfbdf7aa35e9285833d7f
-
SHA512
e282e820fcab7dfea0997d40503ad7677e9591b50be57451087956667757303ed105e6c149c05aa133a38f6babb51a0b1a13893bb45b66f760938c4012dbf001
-
SSDEEP
49152:loFb0aZZadZ7DGT5J/vFVTlchJgDw4ANlyAt7Q0aSfXVQtsqQtsjrXw:loFb0aZZarH4VTlAtxzfXVdqdjr
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad69f690a5783c1b6079bebc86b4ca6691166de2b68cfbdf7aa35e9285833d7f
Files
-
ad69f690a5783c1b6079bebc86b4ca6691166de2b68cfbdf7aa35e9285833d7f.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ