Behavioral task
behavioral1
Sample
1544-54-0x0000000000830000-0x0000000001329000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1544-54-0x0000000000830000-0x0000000001329000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
1544-54-0x0000000000830000-0x0000000001329000-memory.dmp
-
Size
11.0MB
-
MD5
68000f66c9b0e936f332342ffe63425a
-
SHA1
456473673d23b012b39bb12528d96ea92017758d
-
SHA256
0c04ff9913fa94695d125a78262e6cd13c5a3ab16e67dfc4e5d9454e3037e9a5
-
SHA512
61aaedc57f6e4841a5eb625167fe797f24459b04859e3525607cdbf918165ee917ca6a99eca59b3c3c0204228b128993e729844d059ccd29e082ab3afb752eeb
-
SSDEEP
196608:c0e/NL4rjuttIUMahy/0MGa9GqaKGoyZgD7PaP2OB4imebi4osI3jhMSN:s/97s+y/0Pa9bygDk7yibdoss
Malware Config
Signatures
-
Privateloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1544-54-0x0000000000830000-0x0000000001329000-memory.dmp
Files
-
1544-54-0x0000000000830000-0x0000000001329000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp:;(� Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp:;(� Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp:;(� Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ