Behavioral task
behavioral1
Sample
2492-62-0x0000000000400000-0x000000000042F000-memory.exe
Resource
win7-20241010-en
General
-
Target
2492-62-0x0000000000400000-0x000000000042F000-memory.dmp
-
Size
188KB
-
MD5
8e6057e3efa0ce261576b3f0c6677cbd
-
SHA1
9425a34af11fd3a93d9c1749a96ad851f8f72994
-
SHA256
01b806ded70451f74937ce76f90a1036e437aa3b56a959355df6f84c9645d521
-
SHA512
3cbe311130f2b790176340e330c2aee02f5437cb1fc944f4c8a9b528279e1242951cf9133633c869b19270ca0ba93aec8af5bdeb5ab2017e00bcebf5acfa924e
-
SSDEEP
1536:+YMNChaEb9Y3R1OK8jqfu/b4A48GFBoagvHxMaBvRSyOHmD7wKHfRNKQFGo:bMNCha6O8jhb4AKDoaSDRS87wKHfRMr
Malware Config
Extracted
arkei
Default
Signatures
-
Arkei family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2492-62-0x0000000000400000-0x000000000042F000-memory.dmp
Files
-
2492-62-0x0000000000400000-0x000000000042F000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 75KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LLCPPC Size: 1024B - Virtual size: 928B
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE