Behavioral task
behavioral1
Sample
2548100x00000000004000000x0000000000442000memorydmp.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2548100x00000000004000000x0000000000442000memorydmp.exe
Resource
win10v2004-20231222-en
General
-
Target
2548100x00000000004000000x0000000000442000memorydmp.exe
-
Size
264KB
-
MD5
3b055a99e0b4dfcb2597b1091f4f7a3f
-
SHA1
d7a73f6c449ea0f8fbb96ea6c3469704bbd53f5c
-
SHA256
5c783e451dee2881400f8ecb86f3f52492cea577c979f95fbd623c97f0e4e893
-
SHA512
cd1ad4faf74dd1dc87a8616c206f183297db6546b027162b91329af9ade26a5f2d4d51d632f9e62918198e532cf61ff72bf24104cba56b423b68cb86e8e538a9
-
SSDEEP
3072:64aWtQoC+iGCTYTlLZCr+OviIDyu5IlgiBzwCrf:64aW3C+iGCTYFZ6+OJDy7gip
Malware Config
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2548100x00000000004000000x0000000000442000memorydmp.exe
Files
-
2548100x00000000004000000x0000000000442000memorydmp.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 235KB - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ