ScreenShot
| Created | 2023.02.27 09:29 | Machine | s1_win7_x6403 |
| Filename | Amadey.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 46 detected (Deyma, Doina, GenericRI, S29487073, Save, Amadey, malicious, confidence, 100%, Attribute, HighConfidence, high confidence, score, GenericKD, BotX, Sgil, DownLoader45, REDLINE, YXDBYZ, Static AI, Malicious PE, AGEN, Detected, GenericRXVE, ai score=89, R002C0DBO23, kxJFejq2FbQ, susgen, EGTS, ZexaF, ouW@amDXACni, Genetic) | ||
| md5 | 17a8f85f937d8106c020a366d7c6ccb4 | ||
| sha256 | 3f3dadd2a5177fb918eabacc6a433d46f1975dd9c18cc0a7b63e09669625b800 | ||
| ssdeep | 3072:up/r/XWcqLhrksdsUrPYdBqaTl723DSVhdu1SAA8YcG9lKVf1svV+NhcmEx:uNzGcU9LPGQaTASlu1STVJGMV+4 | ||
| imphash | dd0e4efabc62274a7cfb37b4b7a2951d | ||
| impfuzzy | 48:6xGX/dJGGOscpe2toS1CM6ZccgTg3IWSqzNWI:tX/CGdcpe2toS1CM6ZctV+v | ||
Network IP location
Signature (15cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 46 AntiVirus engines on VirusTotal as malicious |
| watch | Attempts to identify installed AV products by installation directory |
| watch | Communicates with host for which no DNS query was performed |
| watch | Installs itself for autorun at Windows startup |
| watch | Uses suspicious command line tools or Windows utilities |
| notice | A process created a hidden window |
| notice | Creates a suspicious process |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | Performs some HTTP requests |
| notice | Sends data using the HTTP POST Method |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks amount of memory in system |
| info | Command line console output was observed |
| info | Queries for the computername |
| info | This executable has a PDB path |
Rules (6cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x42c024 GetLastError
0x42c028 GetFileAttributesA
0x42c02c CreateFileA
0x42c030 CloseHandle
0x42c034 GetSystemInfo
0x42c038 CreateThread
0x42c03c HeapAlloc
0x42c040 GetThreadContext
0x42c044 GetProcAddress
0x42c048 VirtualAllocEx
0x42c04c CopyFileA
0x42c050 RemoveDirectoryA
0x42c054 ReadProcessMemory
0x42c058 GetProcessHeap
0x42c05c CreateProcessA
0x42c060 CreateDirectoryA
0x42c064 SetThreadContext
0x42c068 WriteConsoleW
0x42c06c ReadConsoleW
0x42c070 SetEndOfFile
0x42c074 HeapReAlloc
0x42c078 HeapSize
0x42c07c GetTempPathA
0x42c080 Sleep
0x42c084 SetCurrentDirectoryA
0x42c088 GetModuleHandleA
0x42c08c GetComputerNameExW
0x42c090 ResumeThread
0x42c094 GetVersionExW
0x42c098 CreateMutexW
0x42c09c VirtualAlloc
0x42c0a0 WriteFile
0x42c0a4 VirtualFree
0x42c0a8 HeapFree
0x42c0ac WriteProcessMemory
0x42c0b0 GetModuleFileNameA
0x42c0b4 LocalFree
0x42c0b8 ReadFile
0x42c0bc SetFilePointerEx
0x42c0c0 GetTimeZoneInformation
0x42c0c4 GetConsoleMode
0x42c0c8 GetConsoleCP
0x42c0cc FlushFileBuffers
0x42c0d0 GetStringTypeW
0x42c0d4 SetEnvironmentVariableW
0x42c0d8 FreeEnvironmentStringsW
0x42c0dc GetEnvironmentStringsW
0x42c0e0 WideCharToMultiByte
0x42c0e4 GetCPInfo
0x42c0e8 GetOEMCP
0x42c0ec GetACP
0x42c0f0 IsValidCodePage
0x42c0f4 FindNextFileW
0x42c0f8 FindFirstFileExW
0x42c0fc FindClose
0x42c100 SetStdHandle
0x42c104 GetFullPathNameW
0x42c108 GetCurrentDirectoryW
0x42c10c DeleteFileW
0x42c110 EnterCriticalSection
0x42c114 LeaveCriticalSection
0x42c118 InitializeCriticalSectionAndSpinCount
0x42c11c DeleteCriticalSection
0x42c120 SetEvent
0x42c124 ResetEvent
0x42c128 WaitForSingleObjectEx
0x42c12c CreateEventW
0x42c130 GetModuleHandleW
0x42c134 UnhandledExceptionFilter
0x42c138 SetUnhandledExceptionFilter
0x42c13c GetCurrentProcess
0x42c140 TerminateProcess
0x42c144 IsProcessorFeaturePresent
0x42c148 IsDebuggerPresent
0x42c14c GetStartupInfoW
0x42c150 QueryPerformanceCounter
0x42c154 GetCurrentProcessId
0x42c158 GetCurrentThreadId
0x42c15c GetSystemTimeAsFileTime
0x42c160 InitializeSListHead
0x42c164 RtlUnwind
0x42c168 RaiseException
0x42c16c SetLastError
0x42c170 EncodePointer
0x42c174 TlsAlloc
0x42c178 TlsGetValue
0x42c17c TlsSetValue
0x42c180 TlsFree
0x42c184 FreeLibrary
0x42c188 LoadLibraryExW
0x42c18c ExitProcess
0x42c190 GetModuleHandleExW
0x42c194 CreateFileW
0x42c198 GetDriveTypeW
0x42c19c GetFileInformationByHandle
0x42c1a0 GetFileType
0x42c1a4 PeekNamedPipe
0x42c1a8 SystemTimeToTzSpecificLocalTime
0x42c1ac FileTimeToSystemTime
0x42c1b0 GetModuleFileNameW
0x42c1b4 GetStdHandle
0x42c1b8 GetCommandLineA
0x42c1bc GetCommandLineW
0x42c1c0 MultiByteToWideChar
0x42c1c4 CompareStringW
0x42c1c8 LCMapStringW
0x42c1cc DecodePointer
ADVAPI32.dll
0x42c000 RegCloseKey
0x42c004 RegQueryValueExA
0x42c008 GetUserNameA
0x42c00c RegSetValueExA
0x42c010 RegOpenKeyExA
0x42c014 ConvertSidToStringSidW
0x42c018 GetUserNameW
0x42c01c LookupAccountNameW
SHELL32.dll
0x42c1d4 ShellExecuteA
0x42c1d8 None
0x42c1dc SHGetFolderPathA
WININET.dll
0x42c1e4 HttpOpenRequestA
0x42c1e8 InternetReadFile
0x42c1ec InternetConnectA
0x42c1f0 HttpSendRequestA
0x42c1f4 InternetCloseHandle
0x42c1f8 InternetOpenA
0x42c1fc InternetOpenW
0x42c200 InternetOpenUrlA
EAT(Export Address Table) is none
KERNEL32.dll
0x42c024 GetLastError
0x42c028 GetFileAttributesA
0x42c02c CreateFileA
0x42c030 CloseHandle
0x42c034 GetSystemInfo
0x42c038 CreateThread
0x42c03c HeapAlloc
0x42c040 GetThreadContext
0x42c044 GetProcAddress
0x42c048 VirtualAllocEx
0x42c04c CopyFileA
0x42c050 RemoveDirectoryA
0x42c054 ReadProcessMemory
0x42c058 GetProcessHeap
0x42c05c CreateProcessA
0x42c060 CreateDirectoryA
0x42c064 SetThreadContext
0x42c068 WriteConsoleW
0x42c06c ReadConsoleW
0x42c070 SetEndOfFile
0x42c074 HeapReAlloc
0x42c078 HeapSize
0x42c07c GetTempPathA
0x42c080 Sleep
0x42c084 SetCurrentDirectoryA
0x42c088 GetModuleHandleA
0x42c08c GetComputerNameExW
0x42c090 ResumeThread
0x42c094 GetVersionExW
0x42c098 CreateMutexW
0x42c09c VirtualAlloc
0x42c0a0 WriteFile
0x42c0a4 VirtualFree
0x42c0a8 HeapFree
0x42c0ac WriteProcessMemory
0x42c0b0 GetModuleFileNameA
0x42c0b4 LocalFree
0x42c0b8 ReadFile
0x42c0bc SetFilePointerEx
0x42c0c0 GetTimeZoneInformation
0x42c0c4 GetConsoleMode
0x42c0c8 GetConsoleCP
0x42c0cc FlushFileBuffers
0x42c0d0 GetStringTypeW
0x42c0d4 SetEnvironmentVariableW
0x42c0d8 FreeEnvironmentStringsW
0x42c0dc GetEnvironmentStringsW
0x42c0e0 WideCharToMultiByte
0x42c0e4 GetCPInfo
0x42c0e8 GetOEMCP
0x42c0ec GetACP
0x42c0f0 IsValidCodePage
0x42c0f4 FindNextFileW
0x42c0f8 FindFirstFileExW
0x42c0fc FindClose
0x42c100 SetStdHandle
0x42c104 GetFullPathNameW
0x42c108 GetCurrentDirectoryW
0x42c10c DeleteFileW
0x42c110 EnterCriticalSection
0x42c114 LeaveCriticalSection
0x42c118 InitializeCriticalSectionAndSpinCount
0x42c11c DeleteCriticalSection
0x42c120 SetEvent
0x42c124 ResetEvent
0x42c128 WaitForSingleObjectEx
0x42c12c CreateEventW
0x42c130 GetModuleHandleW
0x42c134 UnhandledExceptionFilter
0x42c138 SetUnhandledExceptionFilter
0x42c13c GetCurrentProcess
0x42c140 TerminateProcess
0x42c144 IsProcessorFeaturePresent
0x42c148 IsDebuggerPresent
0x42c14c GetStartupInfoW
0x42c150 QueryPerformanceCounter
0x42c154 GetCurrentProcessId
0x42c158 GetCurrentThreadId
0x42c15c GetSystemTimeAsFileTime
0x42c160 InitializeSListHead
0x42c164 RtlUnwind
0x42c168 RaiseException
0x42c16c SetLastError
0x42c170 EncodePointer
0x42c174 TlsAlloc
0x42c178 TlsGetValue
0x42c17c TlsSetValue
0x42c180 TlsFree
0x42c184 FreeLibrary
0x42c188 LoadLibraryExW
0x42c18c ExitProcess
0x42c190 GetModuleHandleExW
0x42c194 CreateFileW
0x42c198 GetDriveTypeW
0x42c19c GetFileInformationByHandle
0x42c1a0 GetFileType
0x42c1a4 PeekNamedPipe
0x42c1a8 SystemTimeToTzSpecificLocalTime
0x42c1ac FileTimeToSystemTime
0x42c1b0 GetModuleFileNameW
0x42c1b4 GetStdHandle
0x42c1b8 GetCommandLineA
0x42c1bc GetCommandLineW
0x42c1c0 MultiByteToWideChar
0x42c1c4 CompareStringW
0x42c1c8 LCMapStringW
0x42c1cc DecodePointer
ADVAPI32.dll
0x42c000 RegCloseKey
0x42c004 RegQueryValueExA
0x42c008 GetUserNameA
0x42c00c RegSetValueExA
0x42c010 RegOpenKeyExA
0x42c014 ConvertSidToStringSidW
0x42c018 GetUserNameW
0x42c01c LookupAccountNameW
SHELL32.dll
0x42c1d4 ShellExecuteA
0x42c1d8 None
0x42c1dc SHGetFolderPathA
WININET.dll
0x42c1e4 HttpOpenRequestA
0x42c1e8 InternetReadFile
0x42c1ec InternetConnectA
0x42c1f0 HttpSendRequestA
0x42c1f4 InternetCloseHandle
0x42c1f8 InternetOpenA
0x42c1fc InternetOpenW
0x42c200 InternetOpenUrlA
EAT(Export Address Table) is none