amadey | Triage

Resubmissions

12-08-2024 14:48

240812-r6r9eawbmm 10

13-04-2022 03:36

220413-d51x9safek 10

Sharing

Copy URL

Twitter E-mail

General

Target

amadey
Size

6.7MB
MD5

fc33eb2d1bc5bddd539a2d498a758b93
SHA1

c2daa51655e86088bb554e89e047667f60af822f
SHA256

4d02224a7dadfc2d8a1343fdc51e4634a98bd073f867bfd091e667efd112108a
SHA512

ea0da825962b2c4beb67ce7bf54ee4139e47b4b756cc474eea06eb856e75d6b6b98133e8d9e3ebd9508c3fbdb47cc5da62eb81a1206fd3383b0673508e098656
SSDEEP

196608:26/ssSmI4zRjdfl2ykqtSE+eazr3Rldgid4sG59Ml:26vjZAqDaf3Rl9PG6

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

amadey
.exe windows x86

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:0b:a8:77:da:f7:88:a0:04:8d:04:a8:5b:1f:6e:ca
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-06-2020 00:00

Not After

02-07-2021 12:00

Subject

CN=Skylum Software USA\, Inc.,O=Skylum Software USA\, Inc.,L=Bellevue,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

9d:ac:28:3f:d0:02:55:d3:9d:8c:5c:7e:05:b3:55:67:7d:de:4e:22
Signer

Actual PE Digest

9d:ac:28:3f:d0:02:55:d3:9d:8c:5c:7e:05:b3:55:67:7d:de:4e:22

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Skylum Software USA\, Inc.,O=Skylum Software USA\, Inc.,L=Bellevue,ST=Washington,C=US

11-04-2022 16:20
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 2.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 742KB - Virtual size: 744KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 166KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

03:0b:a8:77:da:f7:88:a0:04:8d:04:a8:5b:1f:6e:caCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

9d:ac:28:3f:d0:02:55:d3:9d:8c:5c:7e:05:b3:55:67:7d:de:4e:22Signer

Signature Validations

Verification

11-04-2022 16:20 Valid: false

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 2.3MB

UPX1 Size: 742KB - Virtual size: 744KB

.rsrc Size: 166KB - Virtual size: 168KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

03:0b:a8:77:da:f7:88:a0:04:8d:04:a8:5b:1f:6e:ca
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

9d:ac:28:3f:d0:02:55:d3:9d:8c:5c:7e:05:b3:55:67:7d:de:4e:22
Signer

11-04-2022 16:20
Valid: false

UPX0
Size: - Virtual size: 2.3MB

UPX1
Size: 742KB - Virtual size: 744KB

.rsrc
Size: 166KB - Virtual size: 168KB