0x000b0000000233e9-4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0x000b0000000233e9-4
Size

14.1MB
MD5

7575219ce8aa50be7ccf3bb5a31a3c09
SHA1

b22b4de3fdf7e1d636a7a0dc08380b7494121f5b
SHA256

aab3831d4522d8f80b39b9c6a4a70f06535a7c6ead93a320283fa650096fd736
SHA512

37745c333fa91cb65c4870f1a488717d1afd2f9ad01a52cc4354b7802f2c8ce4d966174a57d583f06ad1954dc28bbdc96c07ec570f434583067e3c42671840df
SSDEEP

393216:2ZDZn53R7oU4A12xNrJ2y75mKr4YYH+EUWpgX:2ZDLR7HHW5B4cW6

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

resource	yara_rule
sample	agile_net

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x000b0000000233e9-4

Files

0x000b0000000233e9-4
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Software\lol\lol\obj\Release\lol.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 14.0MB - Virtual size: 14.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ