Behavioral task
behavioral1
Sample
1304-84-0x0000000000400000-0x000000000080F000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1304-84-0x0000000000400000-0x000000000080F000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1304-84-0x0000000000400000-0x000000000080F000-memory.dmp
-
Size
4.1MB
-
MD5
c446ccb19bce9f9aae0c957315292a38
-
SHA1
33cdd6059285b326ccb4258e138bb65581fbbc62
-
SHA256
7f170fdb2ed4830d4effbd59d3fad84896685aa8fc72b4d6fe3d2f57f7c6bd92
-
SHA512
d912c7ba8d201782376c155781118a6fac5da8bc39e734c1ec9163c0a3ac70c54ca9eb372423b25ef2123acc7e4f564eda5117e3818d32e0efca9d17892eb315
-
SSDEEP
6144:6Jl7Y+F5fHLyhRFMMBd/ySMuViplmpcJc3:6X3LyhPBd/uuVikj
Malware Config
Extracted
amadey
3.69
77.91.124.242/games/category/index.php
Signatures
-
Amadey family
Files
-
1304-84-0x0000000000400000-0x000000000080F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 179KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ