Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
2784-4-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2784-4-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
2784-4-0x0000000000400000-0x000000000040B000-memory.dmp
-
Size
44KB
-
MD5
98845a33a47e2ff0ef8138617723dfa2
-
SHA1
391acfc5c6568b8e878adca82eab50cf6dc4e330
-
SHA256
6ac95e17eb7a66e5d4d5a483af9fc0c0aa8d561bdef7fee6a246c22b55f61f6a
-
SHA512
baba88cfa8b19d12978ae53fe670c56df9dac52633d997ace01e6f0670fcff84f25b91b59e4837f961e56d2ea30f747928df80c446a0eea51e38aa98b54e5d12
-
SSDEEP
768:aggVGeBsLoEmazQYFqMiM2VAyWq0I8xQh6T/gO0VR:ah0gaMYFJiMjJ3I8xQh6Th0
Malware Config
Extracted
smokeloader
pub4
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2784-4-0x0000000000400000-0x000000000040B000-memory.dmp
Files
-
2784-4-0x0000000000400000-0x000000000040B000-memory.dmp.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE