amadey | 242830x00000000004000000x00000000007FA000memory[.]dmp | Triage

Sharing

General

Target

242830x00000000004000000x00000000007FA000memory.dmp
Size

4.0MB
MD5

f64cdf095ed7dcc82c4a16334135c88f
SHA1

334a59581dbae6947cc8ff024bf3ed683522a0cd
SHA256

ff18983d4eb23e0aeb6f3382bd619a8fbacbd36810a5b93dbf9e6334f2324c8a
SHA512

7715a92a284cd172caaef07be7e58666bf65660323d9de77cea60e9823fe2271849a256b34299b7002094ecc317db112fb8557104ce82153d328885cee71a049
SSDEEP

12288:gRmHUXaD/yzl4gH8Mhb+L0mspumesiW1a8i5baM:MaD/yzWgcxLirHti5bl

Score

10^/10

amadey

Malware Config

Signatures

Amadey family
amadey

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
242830x00000000004000000x00000000007FA000memory.dmp

Files

242830x00000000004000000x00000000007FA000memory.dmp
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 330KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ