amadey | b3acf1278ade676aa1f0b682d267f1c69903991e[.]rl | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b3acf1278ade676aa1f0b682d267f1c69903991e.rl
Size

143KB
MD5

6f629c22c6dca16620726c780d44dceb
SHA1

b3acf1278ade676aa1f0b682d267f1c69903991e
SHA256

0d5b2b8ecd7eb5b46fb06ea28a49194a125b5b269774ffd76e0a2d44fe106307
SHA512

9498cb274a63040ed49d78159532ab5cefdae73ab3cf96cbf495272eeabac8b04d0fba7bf78748f19ee89fe7740a341706e0fdca107c1113363ebed01d4bc241
SSDEEP

3072:bMcp9RWtmpy0mbyjJAcrDT6suYAY51R9mhqW8NNboeED:bTp9RWtm0c7XT6sRJnR9PzbJED

Score

10^/10

amadey

Malware Config

Signatures

Amadey family
amadey

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b3acf1278ade676aa1f0b682d267f1c69903991e.rl

Files

b3acf1278ade676aa1f0b682d267f1c69903991e.rl
.exe windows:6 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ