C:\Users\Administrator\Desktop\2023CryptsDone\PacmanFormProject\bin\Debug\Secured\Mlanib.pdb
Behavioral task
behavioral1
Sample
Project Execution Order - (PO 546788) (PO 546789).exe
Resource
win7-20231129-en
General
-
Target
Project Execution Order - (PO 546788) (PO 546789).rar
-
Size
13KB
-
MD5
39fc68f13cfd8a3cd4e280d33b2fc15a
-
SHA1
e41071bca23cf3c29712dd96100b552fd0727f45
-
SHA256
408e418404d842718d88720c6706d3a0a07f40f0e04159091ea31c7333c2f958
-
SHA512
ba8820e4ed7fbb841825cce9ec93ca4c52b75c6d94ef7b47d32fe3aa7ed636b1e93ece898af3975ceb6754d40b5e7d34a2fab870ca9584aba10f31fb184641c5
-
SSDEEP
384:02eHRRWLXPGVRB5D+/x2nUG7Yzuc2eyulGi5q:rGRRisjD+/knDYdyulGX
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule static1/unpack001/Project Execution Order - (PO 546788) (PO 546789).exe agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Project Execution Order - (PO 546788) (PO 546789).exe
Files
-
Project Execution Order - (PO 546788) (PO 546789).rar.rar
-
Project Execution Order - (PO 546788) (PO 546789).exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ