Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
1016-0-0x00000000003E0000-0x0000000000892000-memory.exe
Resource
win7-20241023-en
General
-
Target
1016-0-0x00000000003E0000-0x0000000000892000-memory.dmp
-
Size
4.7MB
-
MD5
4ad0b5792dcc43f53682f41a34e531b2
-
SHA1
4d2d2965124a44c15104b9d9c43acf3254082496
-
SHA256
9abbdab185eaabe66da0ea8386b63949a22bab52dc8022b15b5cdcbd4634f1bf
-
SHA512
d184729411cdc0eda7267cc7dde98bd3e27071fb079f5101b40470de9a15b13f9e0e4df1bc1d6c9cac1b760af9269e118b86c9022928ef43e4919f346ef91aac
-
SSDEEP
24576:idG+HRKLFd2ACViuWz2Tbqeb03i7WQ7m18M5ipe1eaGqMT9Yx9U:FWKJdmVnWz2PG3+WQ7Y5X1evxYx
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1016-0-0x00000000003E0000-0x0000000000892000-memory.dmp
Files
-
1016-0-0x00000000003E0000-0x0000000000892000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 183KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
uywlautx Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zmvwlzyk Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE