Behavioral task
behavioral1
Sample
2304-0-0x0000000001160000-0x0000000001607000-memory.exe
Resource
win7-20240903-en
General
-
Target
2304-0-0x0000000001160000-0x0000000001607000-memory.dmp
-
Size
4.7MB
-
MD5
1ae4b25babd0a6832e33114a0ede013c
-
SHA1
4d6942f4b3eeb4fba86288dcf072c040a7455687
-
SHA256
27cd4d06824e1b13ac3992dc0046c7d74d80d3f9a965ee71f03489fde8f1f7fa
-
SHA512
6192537eaeee57e37e431acf2337b590d03f4a4c199ae01ab14bab5dde6ec8952e6058a091888a3660ad5335a5ffd3f33b59c5cd3a4de58e55a63d5c8a5ff9e2
-
SSDEEP
6144:YHm1D0mHdam/30QCBGGpUFj/J4bTYLlpj:MAaA37qU0Y7
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2304-0-0x0000000001160000-0x0000000001607000-memory.dmp
Files
-
2304-0-0x0000000001160000-0x0000000001607000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 183KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
aiipuwoc Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gjvdpukg Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE