F:\Coding\MVS\C#\Warface\Launchers\Anomo\Anomo\obj\Release\Launcher.pdb
Behavioral task
behavioral1
Sample
96eb14cddc74da9ebef6a79595ea307ca2a84ccf19e8b41acd3c9d5d0aa997aa.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
96eb14cddc74da9ebef6a79595ea307ca2a84ccf19e8b41acd3c9d5d0aa997aa.exe
Resource
win10v2004-20240426-en
General
-
Target
96eb14cddc74da9ebef6a79595ea307ca2a84ccf19e8b41acd3c9d5d0aa997aa.exe
-
Size
13.9MB
-
MD5
0e4328b066b9e759589659b368e62368
-
SHA1
10f921b20c5d0ce490d5891d3e31894ddbdf72cf
-
SHA256
96eb14cddc74da9ebef6a79595ea307ca2a84ccf19e8b41acd3c9d5d0aa997aa
-
SHA512
233510dcb4dcd5ca224e3c3c56c68b3039d03464a1004a4d8dce489d591f8efae3a4876c41fabeaa923b8d9c79fa036d7dd8261c73b7552f5673acd2ccec394f
-
SSDEEP
196608:InVqMirG5a3oUdwiGMYcI7j0XVB7PSjYV4igYXzCjVqMirG5ao:g5ioQGMLI0FNqkBrCj5N
Malware Config
Signatures
-
Detects encrypted or obfuscated .NET executables 1 IoCs
Processes:
resource yara_rule sample INDICATOR_EXE_DotNET_Encrypted -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 96eb14cddc74da9ebef6a79595ea307ca2a84ccf19e8b41acd3c9d5d0aa997aa.exe
Files
-
96eb14cddc74da9ebef6a79595ea307ca2a84ccf19e8b41acd3c9d5d0aa997aa.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 13.9MB - Virtual size: 13.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ