Behavioral task
behavioral1
Sample
2024-11-24_43b201729678800539cb685d9b601ea0_smoke-loader_wapomi.exe
Resource
win7-20240903-en
General
-
Target
2024-11-24_43b201729678800539cb685d9b601ea0_smoke-loader_wapomi
-
Size
125KB
-
MD5
43b201729678800539cb685d9b601ea0
-
SHA1
390e8f15540fec40b37d0af1c5b259c5a30f3b70
-
SHA256
6c7f2af6b0e4a4282ad2db2a1303e37e3707334e5d9a5b30c9bc5be14a39758e
-
SHA512
5d115db22692751b74eba30096f00a78f0b14d641a94752917ccf141e5a928bf64b4fc9f96aa6fce13db23a84843d7a48c0855c0b160e9068170f43a81e472f5
-
SSDEEP
3072:IH451OJpM1uOcIbqaORUF0/+8v51AwGoG94dF/GCH:x4pM1uLIbCKFq++RGT4dFu
Malware Config
Signatures
-
Processes:
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-11-24_43b201729678800539cb685d9b601ea0_smoke-loader_wapomi
Files
-
2024-11-24_43b201729678800539cb685d9b601ea0_smoke-loader_wapomi.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 568KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 101KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
M֠��u~ Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE