amadey | 2976-210-0x0000000000390000-0x0000000001026000-memory[.]dmp

General

Target

2976-210-0x0000000000390000-0x0000000001026000-memory.dmp
Size

12.6MB
MD5

827786fb4612d5dd04cbb1c3a0f32f3a
SHA1

67285fcc8e0a1fd4f58fbce3c46caff9c49ef69f
SHA256

c1e6c150127e2d558afbf9d7a4dd0a43bcb3633e186c86e6a40a105bada8716c
SHA512

1199f2004e9fef37a663ffa6ed2b9860f8d7b5af685c5c58ee5725e9694ff4989418626450e246d0a7ade2c370e5988a39f16edf7e62ed58e96ba5ad16321291
SSDEEP

196608:naPC916sLWDuiDa+y0PDqKPGBaR+OGZPuknu4ONAzGxKJXuqIg1JJp9:aPC97Lric0PDJPGBcklED+us1JJp9

Score

10^/10

vmprotect amadey

Malware Config

Extracted

Family

amadey

Version

3.85

C2

45.9.74.166/b7djSDcPcZ/index.php

45.9.74.141/b7djSDcPcZ/index.php

Signatures

Amadey family
amadey

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2976-210-0x0000000000390000-0x0000000001026000-memory.dmp

Files

2976-210-0x0000000000390000-0x0000000001026000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.:.:.:.:
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.:.:.:.:
Size: 1024B - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.:.:.:.:
Size: 6.7MB - Virtual size: 6.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 191KB - Virtual size: 643KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: - Virtual size: 166KB

.rdata Size: - Virtual size: 33KB

.data Size: - Virtual size: 9KB

.vmp0 Size: - Virtual size: 1.5MB

.vmp1 Size: - Virtual size: 1.9MB

.:.:.:.: Size: - Virtual size: 1.7MB

.:.:.:.: Size: 1024B - Virtual size: 524B

.:.:.:.: Size: 6.7MB - Virtual size: 6.7MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 191KB - Virtual size: 643KB

.text
Size: - Virtual size: 166KB

.rdata
Size: - Virtual size: 33KB

.data
Size: - Virtual size: 9KB

.vmp0
Size: - Virtual size: 1.5MB

.vmp1
Size: - Virtual size: 1.9MB

.:.:.:.:
Size: - Virtual size: 1.7MB

.:.:.:.:
Size: 1024B - Virtual size: 524B

.:.:.:.:
Size: 6.7MB - Virtual size: 6.7MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 191KB - Virtual size: 643KB