Behavioral task
behavioral1
Sample
2088-0-0x0000000000E90000-0x0000000001358000-memory.exe
Resource
win7-20240221-en
General
-
Target
2088-0-0x0000000000E90000-0x0000000001358000-memory.dmp
-
Size
4.8MB
-
MD5
c5d296cbc8895a0a0c725aeb1f58ace7
-
SHA1
ab9efb3a95277445ce3b946cfe059373bd763a77
-
SHA256
fbd4d90adacb6d6de9d8aa84c98c75b49535e764ecdfd7c07c3b9e315da7830d
-
SHA512
fa348dcdc72e0546314739e6a280ea4142be0e5c09ea5118990766fe82ddb690e75f13af33736522797d9a7f41d67ef43fc1803c01a9821d117472d11b1aabb8
-
SSDEEP
24576:VBTG3XTVNv6qluBLpsJBHZgnWwkqbO5LdL4scT7h8DU54VC8dzbMWTk:VBGnrv6Ywds7Zgza5dLkTl8DU5ax1br
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2088-0-0x0000000000E90000-0x0000000001358000-memory.dmp
Files
-
2088-0-0x0000000000E90000-0x0000000001358000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 181KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fjddabsm Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
edftdmls Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE