Behavioral task
behavioral1
Sample
1520-73-0x0000000000400000-0x00000000015A2000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1520-73-0x0000000000400000-0x00000000015A2000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1520-73-0x0000000000400000-0x00000000015A2000-memory.dmp
-
Size
17.6MB
-
MD5
8cb54cfa07b1b13bc0830de4945d882d
-
SHA1
99a35cc3f0545d76ecc1044cc4ad22909c57f1bf
-
SHA256
fb408f7f43d8623053ea7d915a00fd0d1f47424b22759f69309ae1f4df07ffa8
-
SHA512
09b6ef3bb8a04bb8eeb66ffc67e4f05d1e4df1c81ee25c8403ee1bb3919b6b5d2bf7ff81810f1aff4dae1849233fec7ff681e885f5f8870aab5763efe0fc4a6c
-
SSDEEP
12288:sVtFVPSRE53jT9U/whnKZad2WB/m9s0LOSfmiIxG:hHIBjSOe
Malware Config
Extracted
nymaim
45.139.105.171
85.31.46.167
Signatures
-
Nymaim family
Files
-
1520-73-0x0000000000400000-0x00000000015A2000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ