Behavioral task
behavioral1
Sample
1916-0-0x0000000000220000-0x00000000006CF000-memory.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1916-0-0x0000000000220000-0x00000000006CF000-memory.exe
Resource
win10v2004-20240611-en
General
-
Target
1916-0-0x0000000000220000-0x00000000006CF000-memory.dmp
-
Size
4.7MB
-
MD5
7bbcaf7b1be3897a568aa38bb7207a68
-
SHA1
fa6967d5036cf95c03ee588bb6df69d6db53b60d
-
SHA256
9678a81d5b05dde9bb027cb2e438a691a67b2f414a3bcf6afb8797c31076bb0c
-
SHA512
26b434991166946461a270f73d84824ce7c7caf9a1c9192597b1c9645874d357895b1921b0468f923d59af336196296276095a36b50c0154829df1ec86000e2d
-
SSDEEP
24576:nM2W93D5/oxBCI9TBweeXQW6TX7JTsq3KW2MyPgkZx7JRXny:M223ho1TBwB67DkMyPgoNJRX
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1916-0-0x0000000000220000-0x00000000006CF000-memory.dmp
Files
-
1916-0-0x0000000000220000-0x00000000006CF000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 183KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dwxufhxp Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fyftypsh Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE