Behavioral task
behavioral1
Sample
2512-0-0x0000000000FF0000-0x000000000149A000-memory.exe
Resource
win7-20240729-en
General
-
Target
2512-0-0x0000000000FF0000-0x000000000149A000-memory.dmp
-
Size
4.7MB
-
MD5
89134df8ebbedc2ba050da440405c7e9
-
SHA1
f36a9117d4557a339d15355f342e1192a65c1734
-
SHA256
5c8ad661339ab2f08dae115caaa4a7965fd4cd009c81916acf9da2b01c047499
-
SHA512
786870da371878f1c6523c1fa8805f9eac5b9ab330b3d53284fea1f2ef3458a6916d43510936ade478f5864cd753818298cd6a46f4378887fcefe0c77f0f3185
-
SSDEEP
3072:3k7zrgNGi51jAPDugqK4mYI1BOgn+Q8iVRv1wPCPVu7vRUzYx8tDXUgdm+u8d0oY:0I1jAPDuguEKiVRv1wKo77+QgQ8d0Tk
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2512-0-0x0000000000FF0000-0x000000000149A000-memory.dmp
Files
-
2512-0-0x0000000000FF0000-0x000000000149A000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 183KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zrmuldmj Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ehnlbhck Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE