Behavioral task
behavioral1
Sample
2792-66-0x0000000006B00000-0x0000000007091000-memory.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2792-66-0x0000000006B00000-0x0000000007091000-memory.exe
Resource
win10v2004-20240412-en
General
-
Target
2792-66-0x0000000006B00000-0x0000000007091000-memory.dmp
-
Size
5.6MB
-
MD5
aaa3d94c45a14decb0a2e7f5a5a9667e
-
SHA1
00c4aee53b136db4ba31a645723ba45bf51c5f18
-
SHA256
64836c5203695fbfebb3d1cf5adf697ab0dd2d7f46db359d2be5f55072a4b5e4
-
SHA512
1085c875e54f2b83d41743e287ea3b75108f6f5fb7d54d31fdbec5682fb550f0b9a9e142d3057d3153d9ee57840740d6949cf7d93bf8ca7c379aa54b64ef3041
-
SSDEEP
98304:exnnO05HTN/fq849K83w7XsgVDoYh8Vz8V:cBVk3wIgred8V
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2792-66-0x0000000006B00000-0x0000000007091000-memory.dmp
Files
-
2792-66-0x0000000006B00000-0x0000000007091000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 186KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
byqduimw Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
otarkcdf Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE