Behavioral task
behavioral1
Sample
1180-185-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1180-185-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1180-185-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
66473eac9ab0876b770312c52581f306
-
SHA1
7b7daf8cda14a3711e5210148c066c2bef9eceea
-
SHA256
d29d8eb8cf5d687cb7639a53f08af7d723b234c445d701c44e48dc3327bcdc2b
-
SHA512
264c586a1253209c50c6416187b8a52dbd6dfb84e71748262bd13c29f95a3cd9b348cc630ffe0cf42a1f5476bc2f2ba204771d0a52bd6e3f1c16728be20cff4f
-
SSDEEP
6144:XIthH5K8eEc1NX6GUMhtEsJYRg1sBKZiMu3ZN5FP8G1zie:XIt15K8XcXHhvG1z
Malware Config
Signatures
-
Agenttesla family
Files
-
1180-185-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ