c:\Dropbox\Dev\ag.v64\Libraries\VMRuntime\obj\Release\AgileDotNet.VMRuntime.pdb
Behavioral task
behavioral1
Sample
9d8334535573bcad2d5926e24e26bc50N.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
9d8334535573bcad2d5926e24e26bc50N.dll
Resource
win10v2004-20240709-en
General
-
Target
9d8334535573bcad2d5926e24e26bc50N.exe
-
Size
428KB
-
MD5
9d8334535573bcad2d5926e24e26bc50
-
SHA1
31405cea62f33ecfe1f9aa4c6ab57aae03aea360
-
SHA256
0d4d8e18bce28ae0b64f0bd242042f9cf729ca6a8eaf56ed443fa09e7e29d6d7
-
SHA512
41a3dbe257b4662a04c09224b8beb1f0c44cee3735e1f79555901d328478237f0a6be88ac6d829563ca3e2bb707fce2426958aeecc5356c1eac098e2fbbf5714
-
SSDEEP
3072:rsRba+6OshJD9fBvDuSd7zdoF5sZDimhSJJ8Muk+9l6Fqd6pKzZnYwq3xr:rCba+6BJD9fBLl6rsFhIzuk+9l66YNx
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9d8334535573bcad2d5926e24e26bc50N.exe
Files
-
9d8334535573bcad2d5926e24e26bc50N.exe.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 425KB - Virtual size: 425KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ