Behavioral task
behavioral1
Sample
2808-78-0x0000000006870000-0x00000000070DD000-memory.exe
Resource
win7-20241010-en
General
-
Target
2808-78-0x0000000006870000-0x00000000070DD000-memory.dmp
-
Size
8.4MB
-
MD5
0d587f4ff1632bc7fd69d7bf3474f696
-
SHA1
44d04f36ec12ffd3b1c21397c2029dd25113fac5
-
SHA256
89b7d18c41afe07ef3b6b235d2c6fab92d59a5870873cf58452aeae47663384d
-
SHA512
6cf3f17c26105b04d14b9998dfaca615fa05822fb7cdba1362e299bbf252d23d4504d25978d53b911b2c95a10ba19f44c8734807ce7fca3c0c1d6f58a5567ed0
-
SSDEEP
98304:D3NqMtiAFGlXMevc8bCBSjKG5D3G+4B3NqMtiEFGlXMevc8bCBSjKF503G+403Nq:DRKBTT5D3hilKBT8503hjRKBTT5h
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2808-78-0x0000000006870000-0x00000000070DD000-memory.dmp
Files
-
2808-78-0x0000000006870000-0x00000000070DD000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 416KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
moosgoxh Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
babkyveu Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE