Behavioral task
behavioral1
Sample
2008-0-0x0000000000860000-0x0000000000D26000-memory.exe
Resource
win7-20240221-en
General
-
Target
2008-0-0x0000000000860000-0x0000000000D26000-memory.dmp
-
Size
4.8MB
-
MD5
c51d3a306cd8ca8e9726a796da424606
-
SHA1
9d6f1ed7de5b1e247d63d4bfab104db3ebc2031e
-
SHA256
0e0ddf3654f333b5218f0ef49c4e5cc70558561f73206b29ea75499b94f9bc56
-
SHA512
40a40bb6f96efda0312333eefe4115ed9aab70cb1fab7243ce18eae0117e7caa06d589524d73623b8e790fdbe7be952827dc95bdb3eaed61e5ad492826d4342f
-
SSDEEP
49152:nL24QcBay3Zl6YwpPwGg7ONxmapihmL5:i4QcBLZl6YKPwGocIapihm
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2008-0-0x0000000000860000-0x0000000000D26000-memory.dmp
Files
-
2008-0-0x0000000000860000-0x0000000000D26000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 181KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jiqkrnug Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ztwurksn Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE