Behavioral task
behavioral1
Sample
616-0-0x0000000000380000-0x000000000082D000-memory.exe
Resource
win7-20240220-en
General
-
Target
616-0-0x0000000000380000-0x000000000082D000-memory.dmp
-
Size
4.7MB
-
MD5
946b1dcd0f60002b7ec69c7f2c8052ef
-
SHA1
48df7e7fe1e3b9b87ae3ec76bff107ecef1b6c46
-
SHA256
7c1d639a27e3be190540b590a78aa48fdff0c953bc3437cb040fca1915807fa2
-
SHA512
2d4e11b7be612c7134ac99d51f6de9fc8cb45e422f6c30c1980fbbcff42b49c7b04095974a66a9125bb169e7d5054f96a9a3bbcd0001812e79680da4a89a5f56
-
SSDEEP
24576:YLbQq8TveZSnYaM07362/lrHLsYLLN8pxF/M3+aYTGG9RkbT0C21HUs:A8re/arZsgNonSKTPRco
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 616-0-0x0000000000380000-0x000000000082D000-memory.dmp
Files
-
616-0-0x0000000000380000-0x000000000082D000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 182KB - Virtual size: 408KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zhnfvked Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nrhhkbag Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE