Behavioral task
behavioral1
Sample
4208-240-0x0000000000400000-0x0000000000583000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
4208-240-0x0000000000400000-0x0000000000583000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
4208-240-0x0000000000400000-0x0000000000583000-memory.dmp
-
Size
1.5MB
-
MD5
0cee4eb568da150f88fd728e27883a42
-
SHA1
5b00f3147465c416979947b02967262f94735736
-
SHA256
6b8712f5d7d8f2be748a3e171ed980969663f59ed03dca5098b87dd18ca9e789
-
SHA512
cdf8d5495cb3a108b17ec7b8c7a3de32ce5b3869ddd44e23947be4f872640a48e08467cd14a7e512c676de70d03213abd83a100738eba6ec425d1b481a2f323c
-
SSDEEP
6144:ppnePpmFkSYuod8e057E7E/PZlUuFyQL4VCNqMOwL9:LUSY105+2ZlUuFyQLrTh
Malware Config
Extracted
amadey
3.67
212.118.43.106/dF30Hn4m/index.php
Signatures
-
Amadey family
Files
-
4208-240-0x0000000000400000-0x0000000000583000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 189KB - Virtual size: 189KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ