Behavioral task
behavioral1
Sample
1504-3-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1504-3-0x0000000000400000-0x000000000040B000-memory.exe
Resource
win10v2004-20240508-en
General
-
Target
1504-3-0x0000000000400000-0x000000000040B000-memory.dmp
-
Size
44KB
-
MD5
915d41c59335f6f2227fa1169297f617
-
SHA1
23e4d7ae8ce4082c7ab3a5f9720370ae7dee66fe
-
SHA256
5da886a8449e7e8d74ef4088f8c5b07771753bf2fbcae0a76eb5482c9d395e8b
-
SHA512
1d98805eceaec30171e6ef8ddc0b61c0fc9cc082f6354305e97b7b3dabb5f8f249598d7af7ac30816681874b0c56f1c5589b99f19b82aa06371eabbf2f601ab7
-
SSDEEP
768:Z/8mWE+vc4j6DhR8ZSDc28hO3c3VgDeoVZnE:2a+04j6DhR8658533s
Malware Config
Extracted
smokeloader
pub2
Signatures
-
Smokeloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1504-3-0x0000000000400000-0x000000000040B000-memory.dmp
Files
-
1504-3-0x0000000000400000-0x000000000040B000-memory.dmp.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE