Behavioral task
behavioral1
Sample
2976-0-0x0000000001050000-0x000000000151C000-memory.exe
Resource
win7-20240221-en
General
-
Target
2976-0-0x0000000001050000-0x000000000151C000-memory.dmp
-
Size
4.8MB
-
MD5
edd9b066c9260aa9bb8f067044e01128
-
SHA1
a92d4dd413a204cb67b7d8e0b2fa150571467825
-
SHA256
d38abe3cb4ffe50261263d35a3f5153942d4b6cbd4dd1d1abf11835e30941c0f
-
SHA512
86956839b1b99d40638f90cf5a69a5c9c9cf5aac476a54d6853141a8a447cf1c43d0cf23339717446a0ef8544483ae42de78a5f35cce71775c670dfe5224fbc4
-
SSDEEP
3072:5EfJhaTfkRFNNlOplcF1mN1FdayHe52oSakGM/sxeHZjSTPEr9jsZkdvsbeHjW0:uJhajkxlS1FdayHe4OrCMTW9jswveel
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2976-0-0x0000000001050000-0x000000000151C000-memory.dmp
Files
-
2976-0-0x0000000001050000-0x000000000151C000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 186KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
mesglibp Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tqqkuuas Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE