Behavioral task
behavioral1
Sample
2100-0-0x00000000003F0000-0x00000000008A8000-memory.exe
Resource
win7-20240221-en
General
-
Target
2100-0-0x00000000003F0000-0x00000000008A8000-memory.dmp
-
Size
4.7MB
-
MD5
f14d6e51d34942633a054ab7feb7fd5f
-
SHA1
433cbb0b84d0e2411a1594962c579e4dc76057e0
-
SHA256
baff95fbbac900b0c57cef5a00d5c19cb0758bd0175f7f8245a876cf86045e69
-
SHA512
2bd3f17da71c86324a6e02cc2b8b8037f63a5df54ca7f604a454556ab07c88fd6efc3cba791cfd058ebe5b6baacedd0db5d7374fbc7c79cbc9a796c295b96c25
-
SSDEEP
24576:CwATfeRlGD1LchJlsl8Pd6JXkt9/wj4aihL25p9lqkqD41HpnM:2rklaGhq8lEqWjXiV2jn841HK
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2100-0-0x00000000003F0000-0x00000000008A8000-memory.dmp
Files
-
2100-0-0x00000000003F0000-0x00000000008A8000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 186KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qygfsyuy Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ixersrmr Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE