F:\Coding\MVS\C#\Warface\Launchers\Anomo\Anomo\obj\Release\Launcher.pdb
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.ABRisk.VTZE-2830.26480.4550.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W32.ABRisk.VTZE-2830.26480.4550.exe
Resource
win10v2004-20240508-en
General
-
Target
SecuriteInfo.com.W32.ABRisk.VTZE-2830.26480.4550.exe
-
Size
13.9MB
-
MD5
0e4328b066b9e759589659b368e62368
-
SHA1
10f921b20c5d0ce490d5891d3e31894ddbdf72cf
-
SHA256
96eb14cddc74da9ebef6a79595ea307ca2a84ccf19e8b41acd3c9d5d0aa997aa
-
SHA512
233510dcb4dcd5ca224e3c3c56c68b3039d03464a1004a4d8dce489d591f8efae3a4876c41fabeaa923b8d9c79fa036d7dd8261c73b7552f5673acd2ccec394f
-
SSDEEP
196608:InVqMirG5a3oUdwiGMYcI7j0XVB7PSjYV4igYXzCjVqMirG5ao:g5ioQGMLI0FNqkBrCj5N
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.W32.ABRisk.VTZE-2830.26480.4550.exe
Files
-
SecuriteInfo.com.W32.ABRisk.VTZE-2830.26480.4550.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 13.9MB - Virtual size: 13.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ