Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
2812-70-0x0000000006A30000-0x00000000070C0000-memory.exe
Resource
win7-20240903-en
General
-
Target
2812-70-0x0000000006A30000-0x00000000070C0000-memory.dmp
-
Size
6.6MB
-
MD5
b8e736c5308a0e41f2c08719ed8533f9
-
SHA1
07cd519df669a44baecb32d6806fb0375001ce10
-
SHA256
a0103d400269bd57caf453aa20ee685ea6ca150b551bdc051591e7665d68c77e
-
SHA512
e2cc14cc6d6db15dd59cc5f0e6404ce8a826f21c9e7b118a78c209b4597c01f8ef3ea859f31007e8286418644759a932006a3ff63fcddfb6ba790f367accaa15
-
SSDEEP
98304:0AEUcKSGQjkH2ubJO0ladL7apvvtVeJs/AEUcKSNQjkH2ubJO0ladL7apvvtVeJC:0jLupNwJ82LupNwJnC
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2812-70-0x0000000006A30000-0x00000000070C0000-memory.dmp
Files
-
2812-70-0x0000000006A30000-0x00000000070C0000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 416KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
snbfnslf Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ttwcvhtl Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE