Behavioral task
behavioral1
Sample
280490x00000000004000000x0000000000444000memorydmp.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
280490x00000000004000000x0000000000444000memorydmp.exe
Resource
win10v2004-20231222-en
General
-
Target
280490x00000000004000000x0000000000444000memorydmp.exe
-
Size
272KB
-
MD5
5e86bbdf8aa251d417502cd5ffd7d5f7
-
SHA1
3997da474d67c921262d8a39fd35150d0f8b6fc3
-
SHA256
4c6bd037a4f91655aeda8f141098829dd2c6312ac5c85fee7573ff4db833b872
-
SHA512
e7d0a57dd72d814cfa5376d8f2ad0b1b3d022773801e8d69028669ade5a95075dd61eee295194acdf661b778b72cdebbebf0f4ad49fa608b4bcd9a11cb4ab121
-
SSDEEP
3072:yVEjbHLfLVsHhayWvLmHGQfkHx25Nr6HBqJwJ:yVEjbHLfLVsHhayWyHGQ8RE6H8
Malware Config
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 280490x00000000004000000x0000000000444000memorydmp.exe
Files
-
280490x00000000004000000x0000000000444000memorydmp.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 244KB - Virtual size: 243KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ