Behavioral task
behavioral1
Sample
2032-0-0x0000000000E90000-0x0000000001348000-memory.exe
Resource
win7-20240221-en
General
-
Target
2032-0-0x0000000000E90000-0x0000000001348000-memory.dmp
-
Size
4.7MB
-
MD5
1a4a1cb3faac014d8fb0c44071b80cf7
-
SHA1
b79011772f9814564b6425ac0da3f9c2275e710a
-
SHA256
a406575c9240cc3914880d49edef1d4cd7cd8853a0c03b0f557f4efc13857801
-
SHA512
d48c848c0bd06c31cb881fb4793fd7e6b27dce6c5599b27ec7a0a4696b9e81f0138dda0c43b9b22eb105d25892dc92799d57010558e1ad26e6fc14224165e547
-
SSDEEP
24576:v6LWmHyz9vZNlyK21kOns/Lpt0e0Bh9rnLpGqqeWDvVW8aCfAen:v+Wi2vZfjhzv0fLpGeMvVxa
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2032-0-0x0000000000E90000-0x0000000001348000-memory.dmp
Files
-
2032-0-0x0000000000E90000-0x0000000001348000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 181KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jgudcpuf Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fpoinilh Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE