Behavioral task
behavioral1
Sample
1760-0-0x00000000006D0000-0x0000000000B8C000-memory.exe
Resource
win7-20240220-en
General
-
Target
1760-0-0x00000000006D0000-0x0000000000B8C000-memory.dmp
-
Size
4.7MB
-
MD5
48f2dac1db88f9fecc8346db84b982b0
-
SHA1
a5178b8811901b44410e10f90d77f42729861a9f
-
SHA256
03ae5e4a2bba9c238edf51d48256c0bbbec067afb75b4188e9d8e2e07025f311
-
SHA512
59417adabae6556114a81d15cd2816678b0264f3276e8daee261f71c1ab882c778e475409863e289119bcef26f05956aacc0526ed620d87742a35aec491bdf4f
-
SSDEEP
24576:Tl/6onZGvj9qZFQyLsxmk5VxsnGiClF2HFMOAyTC/5Gl/XlWRM0:TZ6oAj9EFKvxXFyRG/5E/XliM0
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1760-0-0x00000000006D0000-0x0000000000B8C000-memory.dmp
Files
-
1760-0-0x00000000006D0000-0x0000000000B8C000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 181KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
yedrwfcn Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
esutxyxr Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE