Behavioral task
behavioral1
Sample
2240-4-0x0000000000400000-0x000000000043E000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2240-4-0x0000000000400000-0x000000000043E000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
2240-4-0x0000000000400000-0x000000000043E000-memory.dmp
-
Size
248KB
-
MD5
f77b8a6c4eaf71eb489bd135758a1f35
-
SHA1
f20c1253ae715c90444079347c43319d0de30f3b
-
SHA256
93a63ac3922156e31c540e53e007b650b35776af61c08cd837ecfed642f0cbf2
-
SHA512
3d25f12eda7fde3119e54250dc5480d76a8a0dd8c6cfd804e19fab9ad0d1ace1e5be7b7e12b0d284764f5515312cc96de760c6b3c1f480ae629180a19cd3a4a5
-
SSDEEP
3072:6DVCyFxSYACXFzpII9Ns1KMnwFlscekf3O2D+sYc++2hfRvkfAae:6DVCynACXFzpIKTlsclz+PyiVf
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Signatures
-
Tofsee family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2240-4-0x0000000000400000-0x000000000043E000-memory.dmp
Files
-
2240-4-0x0000000000400000-0x000000000043E000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ