Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
3000-3-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3000-3-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win10v2004-20240802-en
General
-
Target
3000-3-0x0000000000400000-0x000000000040B000-memory.dmp
-
Size
44KB
-
MD5
a580e82aa48fa5fe9dc98b2c2973bd49
-
SHA1
e94dadf49f6414dd206a3d503c255ab96bd76e40
-
SHA256
c647c28c8f3f9ed865a73e607730ff85530e38de2cfc20f9dbaee3c269cf0025
-
SHA512
d017f64d70f835e9fe60d7e794e4cca4b39a9d40a404d734c05032b91ec719e2a5add7c3f496951a490b4f48482ef7b0fbd4f8a83433d369cfa1d39716572484
-
SSDEEP
768:LaFq5EYUKNuZNe3moyGali+xD1Ux+v/RN:LaEzUnXCXyRJxw6j
Malware Config
Extracted
smokeloader
pub2
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3000-3-0x0000000000400000-0x000000000040B000-memory.dmp
Files
-
3000-3-0x0000000000400000-0x000000000040B000-memory.dmp.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE