Behavioral task
behavioral1
Sample
2184-0-0x00000000000F0000-0x00000000005BE000-memory.exe
Resource
win7-20240611-en
General
-
Target
2184-0-0x00000000000F0000-0x00000000005BE000-memory.dmp
-
Size
4.8MB
-
MD5
24b59837013fc45263bfc6e5b276f992
-
SHA1
0f9368eabb69988418c2345aa1e32ead6e6b9d2f
-
SHA256
deab8297bee9e596cdf8c8569ee3d0a60a9ba72663fc5633a588bc3150e43b6e
-
SHA512
a5916b83a04ab573b3f86ec50e89bce125d672b5c232a5090d7830e1584ccfcf84ab5203c8e1e9ff47ac912381ce2d64f65cf93b6fb52a628e93b1b0128c20f6
-
SSDEEP
24576:udf0yAApWyhX9YsEZ6eHF0KJGEnQMhgJrhdzZCouGICAEJ8567W:M0jAThvCHOKpPmHzZRnJ8AW
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2184-0-0x00000000000F0000-0x00000000005BE000-memory.dmp
Files
-
2184-0-0x00000000000F0000-0x00000000005BE000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 183KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
vybuqtdd Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
onwfzqtx Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE