Behavioral task
behavioral1
Sample
2412-0-0x0000000000B00000-0x0000000000FA5000-memory.exe
Resource
win7-20240611-en
General
-
Target
2412-0-0x0000000000B00000-0x0000000000FA5000-memory.dmp
-
Size
4.6MB
-
MD5
f567c088da7973e6d71ca8e1a7192f3b
-
SHA1
88f7f3b98207d97c7376e3d065184c19453c2b3d
-
SHA256
d2b8730856aad33d1c20cc1f1db0dead0db4e7f67e55f9687715673781cc9fa3
-
SHA512
b3b98fa0de2c455fdcfdbd81a537683dd8baf67db6e90a0c5384cd12404d89d6e4c2034c33423e3f360ac32ddcd3d7cb23d4cfe99851107e7773d09992b497eb
-
SSDEEP
24576:t81fuCoWg0s+NgiT60qj3D5yEUlewvGXn6oGi+KS6MR0aJcyMKd7:2uTWAicbDTUgwvqHRST
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2412-0-0x0000000000B00000-0x0000000000FA5000-memory.dmp
Files
-
2412-0-0x0000000000B00000-0x0000000000FA5000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 183KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
uhibwetp Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
vzyiljii Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE