Behavioral task
behavioral1
Sample
2308-3-0x0000000000400000-0x00000000004F4000-memory.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
2308-3-0x0000000000400000-0x00000000004F4000-memory.exe
Resource
win10v2004-20231023-en
General
-
Target
2308-3-0x0000000000400000-0x00000000004F4000-memory.dmp
-
Size
976KB
-
MD5
aab477a6dc3f7fd16eac7853231af5f4
-
SHA1
15f34dc6bee2a1b6b79bc325e990f4f58d35af64
-
SHA256
29464c82dd0410a0a8c72cac88e7038a30f3e5995fd7d375c3e237ca5810e42f
-
SHA512
b092358321bc9656b14176d1f85422f6afb2f921c8a7ce40e768dc8ef40c6c9298042479aff2f03c0acfc1aff1de3441b30e2d303d47f187b60a3a0df997f2b5
-
SSDEEP
3072:6DVCyFxSYACXFPpIxuy305RVqMfvYkIe5ST0uamPiCIZ5MNOQRfrAC:6DVCynACXFPpIw33Ke5utfvNOQt
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Signatures
-
Tofsee family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2308-3-0x0000000000400000-0x00000000004F4000-memory.dmp
Files
-
2308-3-0x0000000000400000-0x00000000004F4000-memory.dmp.exe windows:5 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ