Behavioral task
behavioral1
Sample
2244-0-0x0000000000EE0000-0x0000000001392000-memory.exe
Resource
win7-20240220-en
General
-
Target
2244-0-0x0000000000EE0000-0x0000000001392000-memory.dmp
-
Size
4.7MB
-
MD5
7a880e034ebc60dbf33601f8532c8f86
-
SHA1
59af633cc6bd716444d4538aa3c9d594a4a9b972
-
SHA256
4a59793fb9da21adf519f16bcd2f2edf60e5e70bc0fa8ef39cf86e996094827c
-
SHA512
9f6292643fd871714e48caee9fe54295013e33754ebc2165818760db446e5495437fdc9f85f9df13742b94060e6aa4fbaa29295f12bb256acee97f2047ee57e2
-
SSDEEP
49152:QuLff0bvbbgTK5Iloae9jGssijl4mxZGs:Nff0bYe5IloV9jGfw4mxU
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2244-0-0x0000000000EE0000-0x0000000001392000-memory.dmp
Files
-
2244-0-0x0000000000EE0000-0x0000000001392000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 181KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
vmungjxw Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pbztuvvo Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE