Behavioral task
behavioral1
Sample
ba829f9712d4e0f110c5328064c6015a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ba829f9712d4e0f110c5328064c6015a.exe
Resource
win10v2004-20240226-en
General
-
Target
ba829f9712d4e0f110c5328064c6015a
-
Size
16KB
-
MD5
ba829f9712d4e0f110c5328064c6015a
-
SHA1
d341415107426fa16b6a677bb858aedac9c34af7
-
SHA256
65f35a51584aeca0f370fcdae6b8e0b0f5bde9567f107122a1768c534f7d4eac
-
SHA512
c568154eafb98a0603ae9e076b592c3c92f454c9c0a4c7e54785e3d2203edf79ec8f85a9cac653e77458d685ea7419db13d53997452666e35d372e5bb5775ca2
-
SSDEEP
384:Z6f8n07CxhZPx3O+b8LXjcuqeK/ATp+0BCi+/fK0:ZtImhBNO+bQQ/6pjBCiMfK0
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba829f9712d4e0f110c5328064c6015a
Files
-
ba829f9712d4e0f110c5328064c6015a.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ