Behavioral task
behavioral1
Sample
2740100x00000000004000000x0000000000444000memorydmp.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2740100x00000000004000000x0000000000444000memorydmp.exe
Resource
win10v2004-20231215-en
General
-
Target
2740100x00000000004000000x0000000000444000memorydmp.exe
-
Size
272KB
-
MD5
b5a6bd7e0474fddb5e1f63812d631e6b
-
SHA1
c99e5e8c5318f13fc08c46d116f12c9ce997c14c
-
SHA256
cbf99f3cc0bc6eff5c1804e2248d7299d8adee5e73b41d18d695116334169e35
-
SHA512
fe85b9b738604e75b0ae7aa4117735c5653705d3dca5be63f2d0ced01be3b3f9d74c8d1ca66921541b58a3c8d97af13e152664eae50c06e960727f3e73f2f569
-
SSDEEP
3072:GELrhjrrDzyYlpL76d3/dox8ZMTpGtJ4l5YC11e5Ny:GELrhjrrDzyYlpL76h09G/4L1gv
Malware Config
Signatures
-
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2740100x00000000004000000x0000000000444000memorydmp.exe
Files
-
2740100x00000000004000000x0000000000444000memorydmp.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 242KB - Virtual size: 241KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ