Behavioral task
behavioral1
Sample
2920-0-0x00000000010A0000-0x000000000154C000-memory.exe
Resource
win7-20240729-en
General
-
Target
2920-0-0x00000000010A0000-0x000000000154C000-memory.dmp
-
Size
4.7MB
-
MD5
9962b26c8653c2a8c22e812a7eacbeb4
-
SHA1
5ef437ac70fa002ec53fb686c6b3cc6f2ea395d7
-
SHA256
8ac7793563cde79ccca862ad5bd3b2ec974524772de49bc0abf0a2af9f33c739
-
SHA512
310be16f0c9e501fa5b48019005ad3257fdce23d64195424c4df3ca95ffe011e717b1083ecc5015e67d2d67947fe7295cb08e92e133ddd344bfb985780925a46
-
SSDEEP
12288:rYifvZL33NxedlKJlsNkBqxnH2diIBaOuH7mc9HD18tY4xJeowEsougnLn7HA3Nv:hvl/edlKJljBAUirf9j1eeownorngY
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2920-0-0x00000000010A0000-0x000000000154C000-memory.dmp
Files
-
2920-0-0x00000000010A0000-0x000000000154C000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 183KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ndrjygsh Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ryarxtvb Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE