Behavioral task
behavioral1
Sample
5632-251-0x0000000000400000-0x00000000009D1000-memory.exe
Resource
win7-20240215-en
General
-
Target
5632-251-0x0000000000400000-0x00000000009D1000-memory.dmp
-
Size
5.8MB
-
MD5
4de269873b9e4443116feb922e66e074
-
SHA1
9c38dd32223f9ea4f950b2a2ba9362adf8d96046
-
SHA256
f6d34df8aaffdb969c84560af35388629387277f07e5c0a7cb1dea3905a3d583
-
SHA512
33453dce83697f3db2069c32ca85b39c6022c842d155d0d0778224bafed1c8352f6ea9ad8d49616c276d715cb02cabeaa6b603e12133b2290942caa7033d6d28
-
SSDEEP
98304:YzLQBOnDNbD92srUGPw0OIoCYfU9dRJsRQt3RItkDRcTZtl731VsN0tP5fwAyzzT:4UODNbD9rrUGY0OIowvhld6nZlqq9ej8
Malware Config
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5632-251-0x0000000000400000-0x00000000009D1000-memory.dmp
Files
-
5632-251-0x0000000000400000-0x00000000009D1000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 680KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
stzmxbjz Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xwnfpltr Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE