D:\????????????????????????\Framewrok\Library\ProcessLib\ProcessUnitTestingConsole\obj\x64\Debug\ProcessUnitTestingConsole.pdb
Behavioral task
behavioral1
Sample
aca98367382117149039b2c9f1779dc0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
aca98367382117149039b2c9f1779dc0N.exe
Resource
win10v2004-20240709-en
General
-
Target
aca98367382117149039b2c9f1779dc0N.exe
-
Size
90KB
-
MD5
aca98367382117149039b2c9f1779dc0
-
SHA1
e0fa4aa5cc2a3de332ca1239badbebc42dc43d3c
-
SHA256
12f8c635e03b1cf0047f3d6daed80d85fc1ed2fe253d53d7548104357ac7d4d5
-
SHA512
b8e2bf6833b1834006cebf6717d7797b47780ea0a69468975a6d371e1db11a63dbe30b48251309f4e634e9b45eaa9f7b3520b23d8d84e4da74deef8176e03f2f
-
SSDEEP
1536:DaUh3k8wTfzdirCduoJjvbGsQTHZnZLAKwa3fu8LihG5oiKA0QEFVZH3GXzppNMa:DNVk8wVegbGsQT5nhAcvLiHiD0QEX5wG
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aca98367382117149039b2c9f1779dc0N.exe
Files
-
aca98367382117149039b2c9f1779dc0N.exe.exe windows:4 windows x64 arch:x64
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ