Behavioral task
behavioral1
Sample
2992-0-0x0000000000D40000-0x00000000011F4000-memory.exe
Resource
win7-20240508-en
General
-
Target
2992-0-0x0000000000D40000-0x00000000011F4000-memory.dmp
-
Size
4.7MB
-
MD5
3d369844cbc6f2ef603081133336ee4b
-
SHA1
359815306d0aa5673486d4f4249dc665c96c208e
-
SHA256
8ae01f6ba5d839568b50faf86b0f8edc126849e2d5556c2f1adc333592ae3fa5
-
SHA512
6a6e47664fe16f0b176faca38350692baabd66110eaa5d5383342ac3ff0a184782635fee61753c1b4fb55e708662e1a7044efd2a69f6005a9eadf22f8fe61671
-
SSDEEP
24576:Z/+YPzIdZzCWxJ8XK2AGyLerV9isW1gd9/10tIG+hy7G6AWd82LhQafkU9tZX6AY:dRPcOWxKB0LwaNIO3+hyjp6U3My
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2992-0-0x0000000000D40000-0x00000000011F4000-memory.dmp
Files
-
2992-0-0x0000000000D40000-0x00000000011F4000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 181KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dyxzsxvm Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
yohlbykf Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE