Behavioral task
behavioral1
Sample
850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe
Resource
win10v2004-20240426-en
General
-
Target
850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c
-
Size
4.0MB
-
MD5
72c548097b679b745295a4d02e0ab2ff
-
SHA1
780334ff0e1553e28579dba5196dea410d3766f3
-
SHA256
850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c
-
SHA512
d445f4fe56c2d8e740a4f117057ea3a1e512c22211659eeb2a22be447db418aa0953baf4f2e9bc45b3991264b2197f13c3a8bb7729a2f41953bcca0615d7635c
-
SSDEEP
49152:7G/1d593R/hFcx3atpxylbkbXw6YWfr3gq4hU2eUWVqxlMHusr+vdiOeKLgxI:7G/LvR/EzIEsrFIUvqxsusr+1beqP
Malware Config
Signatures
-
Detects executables packed with Babel 1 IoCs
Processes:
resource yara_rule sample INDICATOR_EXE_Packed_Babel -
Detects executables packed with Dotfuscator 1 IoCs
Processes:
resource yara_rule sample INDICATOR_EXE_Packed_Dotfuscator -
Detects executables packed with Goliath 1 IoCs
Processes:
resource yara_rule sample INDICATOR_EXE_Packed_Goliath -
Detects executables packed with SmartAssembly 1 IoCs
Processes:
resource yara_rule sample INDICATOR_EXE_Packed_SmartAssembly -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c
Files
-
850a3955bb167404ea2274d7ea9fc1974289ad14ac219ca3e7b31926dbecc22c.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ