Behavioral task
behavioral1
Sample
ac4157f47b8f07b44ec3bbadee80cb01.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ac4157f47b8f07b44ec3bbadee80cb01.exe
Resource
win10v2004-20240226-en
General
-
Target
ac4157f47b8f07b44ec3bbadee80cb01
-
Size
1.4MB
-
MD5
ac4157f47b8f07b44ec3bbadee80cb01
-
SHA1
79091900dba02bb7565f404fbf4b9f14663e68d6
-
SHA256
4589d40eae06abc832fe603563a8236065b1bdf6237aba682f6a5948aca3a543
-
SHA512
d549799e509d33827847fb58a3b96910acfec494ca225f4ed053313ae86858f071677bf8c989244c22c4bd68d364bc49d872eb5bfcbc28515cc5cbb1e256f47b
-
SSDEEP
24576:I2Wg0nPg0nu0FsIdkysHz5NTRtnzUHhkuAif+mP9YvqwCOSg0n+C:1Wg0nPg0nd+pNJtzUH0if+mP9YSCSg05
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac4157f47b8f07b44ec3bbadee80cb01
Files
-
ac4157f47b8f07b44ec3bbadee80cb01.exe windows:4 windows x86 arch:x86
32c5de998b5f069b26c94c8143b13c06
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
kernel32
GetModuleFileNameW
user32
GetWindow
advapi32
RegDeleteKeyA
shell32
SHGetFolderPathW
Sections
.text Size: 513KB - Virtual size: 632KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sedata Size: 752KB - Virtual size: 752KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 108KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sedata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ