Behavioral task
behavioral1
Sample
1508-24-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
1508-24-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
1508-24-0x0000000000400000-0x0000000000432000-memory.dmp
-
Size
200KB
-
MD5
b57230fc4429d9b3413ccc4256d60356
-
SHA1
ea4c9580b8270122009e004bcee208c371fd1edd
-
SHA256
dd615e7d07e1a8db874e438a82f88cd8d8a4d52c0d868063a45ddb674ab0b761
-
SHA512
d336b864bda3ac4a505ee4c3e415641db9cc88bec0cf8c960de25baf44970ed61da5bfac4cc4032fee0860fb6d06183e068e2eb99d2d3a928e25b246f848f435
-
SSDEEP
768:ZdJitovj9JX3PlqOYWGF0vMF9LSLnr+C2ZbYfkEnM3ePKKKymuKNOAJn8kGt+Q:bJitSjbvYWGqGVSLnrwkMDF5OqoB
Malware Config
Signatures
-
Rhadamanthys family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1508-24-0x0000000000400000-0x0000000000432000-memory.dmp
Files
-
1508-24-0x0000000000400000-0x0000000000432000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 118KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ