Behavioral task
behavioral1
Sample
2856-10-0x0000000000400000-0x0000000000438000-memory.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2856-10-0x0000000000400000-0x0000000000438000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
2856-10-0x0000000000400000-0x0000000000438000-memory.dmp
-
Size
224KB
-
MD5
7cdb46bc66aa2eee2c401f16a9fa167c
-
SHA1
96b8a601aae24a8c20c4ed4b742368de386464b6
-
SHA256
c243b9eef665b8653cc134767cf7158c3d373fe73ca0b9195095f860ba6a022b
-
SHA512
9a46b75337a32bfd8284c2e38410867d972d1f7d13f4b851708232726adb803c4ce2f4fe35d822d9ba14a0916a44a3c90e1ee65cc38898c46ac199b9a1151ed0
-
SSDEEP
3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIL:MLV6Bta6dtJmakIM5
Malware Config
Signatures
-
Nanocore family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2856-10-0x0000000000400000-0x0000000000438000-memory.dmp
Files
-
2856-10-0x0000000000400000-0x0000000000438000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 114KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ