Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
2696-2-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2696-2-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win10v2004-20240802-en
General
-
Target
2696-2-0x0000000000400000-0x000000000040B000-memory.dmp
-
Size
44KB
-
MD5
340f94a03bcb457c5c7a7d957d326f6d
-
SHA1
78d26d2a1072f0bbde39627a5741c4a4a2b7b802
-
SHA256
7c90ff531da3472e49c537e08f34a235806f7caad3f13cd7956a3946f283a21e
-
SHA512
d29bbd44d6861fd309bd33ff1910d84089da21519c172abd0001d0cfbeae2152b908a710b51911997bc9179693ff52930ea0cfd9bb52b2204608f522e1412f9a
-
SSDEEP
384:Lag4KyK3VonRiQwNm5wnDwYLIceMpqY5jPikJ3mbMmVGaegi+xE97ZjM1rYxMdbT:LaFqVYwNuZNe3moyGali+xD1Ux+v/RN
Malware Config
Extracted
smokeloader
pub1
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2696-2-0x0000000000400000-0x000000000040B000-memory.dmp
Files
-
2696-2-0x0000000000400000-0x000000000040B000-memory.dmp.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE