Behavioral task
behavioral1
Sample
3780-341-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3780-341-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
3780-341-0x0000000000400000-0x0000000000409000-memory.dmp
-
Size
36KB
-
MD5
db8f609ec95dd06faa3ab3b528e50ba6
-
SHA1
8a05fea0a5b4e61d89f271487f9e66d6cb0c89c5
-
SHA256
dd2185124569bdec4b21b5ce04031f2e24557af3a2153ecd44f27b3d6e5979f9
-
SHA512
9adfe36d53549f38526e2565a6b201f9b87731d84bb37663763d4b68f5651714f82088b0cd5e81851c64d6322ba78636d3721d94fdcbb6205a9d720afc857690
-
SSDEEP
384:K9VD6tee+O2UOTd2opQTR23aqldz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRg:k6Qe+BUv83PcqdvOXA6XkPslJvGaVW
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3780-341-0x0000000000400000-0x0000000000409000-memory.dmp
Files
-
3780-341-0x0000000000400000-0x0000000000409000-memory.dmp.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE