Behavioral task
behavioral1
Sample
1284-58-0x0000000000400000-0x0000000000464000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1284-58-0x0000000000400000-0x0000000000464000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1284-58-0x0000000000400000-0x0000000000464000-memory.dmp
-
Size
400KB
-
MD5
e5e94deef4a420896511d3a5cbd1c74f
-
SHA1
0ba920fff2f0aa2e09e7b491821ac5de6bd10f29
-
SHA256
b0105ba0893fa1bd77dad3795055d14f5436c729f56310216e4f143cf710cb83
-
SHA512
71b65383d003dc3152aff97705528e9928a1ebbd2b379dfe4813a84015527097b7a8c75addf48661d865f4c8952d961b14a2c91dece263f4eeab2bc710c9b6b8
-
SSDEEP
12288:Udt56ehi/H9SDomjDBvMYojCmDu7CYghMx7R:ciXLDZhW
Malware Config
Extracted
nymaim
208.67.104.97
85.31.46.167
Signatures
-
Nymaim family
Files
-
1284-58-0x0000000000400000-0x0000000000464000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ