Behavioral task
behavioral1
Sample
2400-0-0x0000000000610000-0x0000000000AB5000-memory.exe
Resource
win7-20231129-en
General
-
Target
2400-0-0x0000000000610000-0x0000000000AB5000-memory.dmp
-
Size
4.6MB
-
MD5
66b7846a3037cc2bb6eee3f0e4288765
-
SHA1
9c64fd5f5f2d704800caad1c2c7c143206785e9e
-
SHA256
857a94c5a7ef2b92b2be9ca0e54c1e19ee4dfcfdf9752563360d7ea24a0f7aed
-
SHA512
5b5e80bfd70a02c330a3e27e28dfee7a3105116b26d1a4f4df35fbcd17ec90064e8d8379638e8561f14fb58eda57a5589c5aa6269c045aa925cb7d72bf9555c3
-
SSDEEP
24576:szjSQj+yHHbJMw1vg2C6TjRhH3nBI3IEEL/PYrHhZK0:6jLjVH1Mw1A6PRhJEhrHhw
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2400-0-0x0000000000610000-0x0000000000AB5000-memory.dmp
Files
-
2400-0-0x0000000000610000-0x0000000000AB5000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 183KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
oiaulhph Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
guqgsyem Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE