Behavioral task
behavioral1
Sample
29edfe6f5f1ef11da6747b0d973cb73881ba26d8e416828430507ae2ff203b53.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
29edfe6f5f1ef11da6747b0d973cb73881ba26d8e416828430507ae2ff203b53.exe
Resource
win10v2004-20240802-en
General
-
Target
29edfe6f5f1ef11da6747b0d973cb73881ba26d8e416828430507ae2ff203b53
-
Size
4.8MB
-
MD5
0aef05803672c4b7a38b732276cdb566
-
SHA1
8919f4885ddb3382650fc1608d54b70c5588dc49
-
SHA256
29edfe6f5f1ef11da6747b0d973cb73881ba26d8e416828430507ae2ff203b53
-
SHA512
0b236ad7fb9e076f4abc5b70527f69fe50e80f3046d5ad7eb41a73cb2b378eb754a211d670d271d9d5504ae277cf1aeac3938e3e1b7a3f89a3f27942eb076a1e
-
SSDEEP
98304:EBq5IvqNxLq1yyBcIezUgcX+ifBan9Y00DBTGiJHqLBjOoqx/:nAzBAq104RfI4Hx
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29edfe6f5f1ef11da6747b0d973cb73881ba26d8e416828430507ae2ff203b53
Files
-
29edfe6f5f1ef11da6747b0d973cb73881ba26d8e416828430507ae2ff203b53.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 109.2MB - Virtual size: 109.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ