Behavioral task
behavioral1
Sample
1912-0-0x00000000007C0000-0x0000000000C72000-memory.exe
Resource
win7-20240215-en
General
-
Target
1912-0-0x00000000007C0000-0x0000000000C72000-memory.dmp
-
Size
4.7MB
-
MD5
0162e5868fabe09d9a145fd7df3a804d
-
SHA1
f98dfe025969cb080456eefb9b9778fb29d18c0b
-
SHA256
29b8b92c3abf1f979908a9141ba8667dc5a6ff52f32ad5eb46bd01067b47f891
-
SHA512
9942b04f3d7e7798f38d9b3f51d4d3e6018303dffe8de2fce38da5be2839e8908fb39f7360539c357c60da61dd0156effdfeb99825f660bd4160fbbc1ad9802f
-
SSDEEP
49152:qBI/2Ob26Yevwutw+fKrVryuwf4cnb9sDFD:x/2ObZbvwutw+f8nwf4chsD
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1912-0-0x00000000007C0000-0x0000000000C72000-memory.dmp
Files
-
1912-0-0x00000000007C0000-0x0000000000C72000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 181KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nyyiwvsl Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ozwdgykd Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE