Behavioral task
behavioral1
Sample
2364-173-0x0000000000400000-0x000000000046A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2364-173-0x0000000000400000-0x000000000046A000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
2364-173-0x0000000000400000-0x000000000046A000-memory.dmp
-
Size
424KB
-
MD5
0da0bb75dc6f8baaa47a952dde10c4f4
-
SHA1
16bb3ce77c6c11ddeb252ed6e1352b5c51b0b482
-
SHA256
7f531bba2fc79784500a174ca293ea9e1606864f1993800dce5c9a9deb1fa2a6
-
SHA512
fc148b836e1c53aef5c52e11f1f2c4c9efc957240824e96351c64d8cea2f7bee2ded6db4d6525931cd6a5e0a4acb5fc4c88e49b31560006ecd90cbe3b6c630b2
-
SSDEEP
12288:0ONlVPNIUJHDjttfIhnKZad2WB/m9BccLOSfmiR/Gsd:BfIBqiSO7s
Malware Config
Extracted
nymaim
208.67.104.97
85.31.46.167
Signatures
-
Nymaim family
Files
-
2364-173-0x0000000000400000-0x000000000046A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ