Behavioral task
behavioral1
Sample
1592-74-0x0000000000400000-0x000000000158F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1592-74-0x0000000000400000-0x000000000158F000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1592-74-0x0000000000400000-0x000000000158F000-memory.dmp
-
Size
17.6MB
-
MD5
272689350df0c7c4bc9c9518c9a238b5
-
SHA1
d0abf3583d5aa3a9e2d5928cc7dcc50bb72294ca
-
SHA256
7ccefe8cb05d4f3081977e778b916bd9705414ce8ea35ba271fb76ad9141f85f
-
SHA512
45c75a39e187fcf2714ccbf4de9cd79b44f10405f1e20ac81d65d05fe4a6c4a3b131ebac9356785767066597c40da4a2695bf7fc61ed2f0d2b35fe3735327168
-
SSDEEP
12288:sVtFVPSRE53jT9U/whnKZad2WB/m9QcLOSfmi6xG:hHIBXSOA
Malware Config
Extracted
nymaim
45.139.105.171
85.31.46.167
Signatures
-
Nymaim family
Files
-
1592-74-0x0000000000400000-0x000000000158F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ