Behavioral task
behavioral1
Sample
GADAR.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
GADAR.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
GADAR.exe
Resource
win10v2004-20240508-en
General
-
Target
GADAR.exe
-
Size
47.9MB
-
MD5
2814e71ab1cdf00994521f2c95032c73
-
SHA1
3537800a401c0a8289209583639e542e180d603e
-
SHA256
af09f2db4951c00ccfb6780eea82915afd41d72698e9abadbb66fe9b7a27a7ca
-
SHA512
d07d453ec7d82f0f8e307cef180200d9e8bacad872d95dce06810962ef2b59e02057471899865a3a3eefc2e6d4ebce5ed2938636bb132e7c7401fa6f2fd65bf9
-
SSDEEP
786432:mjy7AtGx1lJZ4FT7tS4H1YfBIMcTJS6s0UYZua3vsEOBkTCYKiDYYGRRqy:ZAMx1lJ0tDHafBjcd2MsF8sYGr
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource GADAR.exe
Files
-
GADAR.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 22.6MB - Virtual size: 22.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 25.0MB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 304KB - Virtual size: 304KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE