Static task
static1
Behavioral task
behavioral1
Sample
GandalfEmailAgent.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
GandalfEmailAgent.exe
Resource
win10v2004-20220901-en
General
-
Target
GandalfEmailAgent.exe
-
Size
1.0MB
-
MD5
116394ab8d5e54a804a66d7d6dd9da1b
-
SHA1
772f7916916542960819d6a32b58449bdd58cd14
-
SHA256
efe8488b0c60dc64e12d3b8247292a66204d6bc34750ec362aed36f6b6894d1a
-
SHA512
3ce93b3fd2d71b028728b62a1f3d1e7859ee834db4c389c38b202fea9435758c9d0079038d994899014780f7664af3c627cf2f0c4e17b9f3d4714eec795dde4b
-
SSDEEP
24576:No8MbmPj0ZKH4lODcxSgo5Gn8WuMRIn+N3gN+zs5KPIVmkXiGzcJy3gt2LER6Gvf:No8Wmb0ZKH4lODcxSgo5Gn8WuMRIn+N+
Malware Config
Signatures
Files
-
GandalfEmailAgent.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ