Behavioral task
behavioral1
Sample
2904320x00000000004000000x0000000000453000memory_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2904320x00000000004000000x0000000000453000memory_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2904320x00000000004000000x0000000000453000memory_JC.dmp
-
Size
332KB
-
MD5
dcb4326fd77aeb7ef98c707db066da25
-
SHA1
5eba61461391c57307eb4cd2a20b0c7f4f4eab43
-
SHA256
545a1dd0dc4ee889cfb7c69f3519d04a16ac0eea46fb4cc7512026aac97631a4
-
SHA512
70369f978a93512c4b75f213a7271de7e5bd043793ea66204737b94c19c53bd2a569546983f7c41f39dcd08bb01d550f5e3e87cb49b6403ce1e4d2f3c5e15371
-
SSDEEP
6144:nDthOzj8VzKGRaGlPi68p+bYXPUN7H4w:nJk8BV668p+bjb4
Malware Config
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2904320x00000000004000000x0000000000453000memory_JC.dmp
Files
-
2904320x00000000004000000x0000000000453000memory_JC.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 238KB - Virtual size: 238KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ