Behavioral task
behavioral1
Sample
1508-0-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
1508-0-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
1508-0-0x0000000000400000-0x000000000040B000-memory.dmp
-
Size
44KB
-
MD5
f4e44b24a2643e11ec11ea0e5e6386bc
-
SHA1
a57aa22f4905fe8bf2d0b03315b53e1dcfa2745a
-
SHA256
c03e30a81fba29ba225852993ccbef2da06c338791a70dfbefdf44c7e55c2ef5
-
SHA512
3b0fd92a0d6a5497c73db5689c747a6cd65ba211f9f7ffe4ce545422dd4b65609f30218515d135d06e91bb67802ed838f80c72c0fb829ea919c76a88ab0de712
-
SSDEEP
768:RR8yqBqJTIH50gUSW9uM7/953mpdH5Yvos0tdB80Z1srmN:r8PePTftV53uV5Ygs0TBymN
Malware Config
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1508-0-0x0000000000400000-0x000000000040B000-memory.dmp
Files
-
1508-0-0x0000000000400000-0x000000000040B000-memory.dmp.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE