Behavioral task
behavioral1
Sample
2336-0-0x0000000000790000-0x0000000000C45000-memory.exe
Resource
win7-20240508-en
General
-
Target
2336-0-0x0000000000790000-0x0000000000C45000-memory.dmp
-
Size
4.7MB
-
MD5
4c70e2da0b12ea91c072d03d62d9c4dc
-
SHA1
6d50c09cebbdd92df8c2e250f4b5ef3a1cf752e4
-
SHA256
7e934f6a6df8095b654c360a0f1bfbf2a97bf886313f69b626b4b236b990e5ce
-
SHA512
cb2870eccb18acb922fe1776f292ad8d4c686c93bf035b0fccb7aba33ae38c29444614ef7b164167d4233f4a24084170cdefc16ca4d59ea4e52fc4f3e0d4dabc
-
SSDEEP
24576:TNfeeoZn6jpKPYPYxZ1WS1clM9VnuHsd:HoF6sPYAZEpSNu
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2336-0-0x0000000000790000-0x0000000000C45000-memory.dmp
Files
-
2336-0-0x0000000000790000-0x0000000000C45000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 182KB - Virtual size: 408KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nfstfheh Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
lidebhkx Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE