Behavioral task
behavioral1
Sample
f6ac93058c6257dee00946df9f7d2c56290386750d38fc2ebc00dc23c58b2353.exe
Resource
win7-20240729-en
General
-
Target
ac1247ec24ed0024003f6ae568d688f8.zip
-
Size
5.8MB
-
MD5
f357830a806a79c9f01ecb4b7d0ce887
-
SHA1
2b172755fa640183cd2db5362c9ffb8d51ae5dcc
-
SHA256
11e22fb0cc000a3a71de77db82ffddbb28cef6678a3ef902f82bc914638285c2
-
SHA512
59bc6a68393a0b318ffd13feef5b291ff0e4f612dc310526e72ac6c0a4462105559549278254b4489fc53a954829f1e6d8bc6a890543105492916e4b5c2fc7f1
-
SSDEEP
98304:MWyIJqHqAgK7ShgEpVajyJy/HE8mbeFGQzDNqpAJ00Reqo7TFEB4Fzy:Zy1qAn7ShxAk7b6zDNuo+qo7TFEGF+
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule static1/unpack001/f6ac93058c6257dee00946df9f7d2c56290386750d38fc2ebc00dc23c58b2353 agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/f6ac93058c6257dee00946df9f7d2c56290386750d38fc2ebc00dc23c58b2353
Files
-
ac1247ec24ed0024003f6ae568d688f8.zip.zip
Password: infected
-
f6ac93058c6257dee00946df9f7d2c56290386750d38fc2ebc00dc23c58b2353.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 860B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ