amtlib[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

amtlib.dll
Size

68KB
MD5

b773cee8aae74e5eb7e0dd3ada08a21e
SHA1

72257f20edc89ad9dbd4da2b8ff5ce5557701ea6
SHA256

5c4606e5734ce62ae45228641a6a4a49491f1b70d6c7da8c0335cb7b11862841
SHA512

805acd61fb17285f4e0f6cf6a948b1ec174e1b793a8c751aa62b152ceb946d2f2daf98e7ea269a9e6db6482c776b84c57dabd0ff9fd7179c65fa1c7d6de5c5b2
SSDEEP

1536:eqNdIQJU1v7Qi8uaghobHz0KW50B/9UVmAown4:h2v7QiFR/KrV9UVmwn4

Score

1^/10

Malware Config

Signatures

Files

amtlib.dll
.dll windows x64

5f931ee6022f63a8566f4e48ef1231f0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shlwapi

StrStrA
StrStrIA

kernel32

CreateProcessW
HeapAlloc
GetCurrentProcess
HeapFree
GetProcessHeap
GetFileAttributesW
CloseHandle
GetPrivateProfileIntW
GetPrivateProfileStringW
WideCharToMultiByte
GetModuleFileNameW
MultiByteToWideChar
GetLastError
GetModuleFileNameA
GetFileAttributesA

user32

WaitForInputIdle

advapi32

SetTokenInformation
OpenProcessToken

shell32

SHGetFolderPathA
SHGetFolderPathW

Exports

Exports

AMTGetCurrentLicenseState
AMTGetLibVersion
AMTGetParentLEIDLicenseStatus
AMTGetProductClearSerialNumber
AMTGetRoyaltyBearingLEIDs
AMTObtainProductLicense
AMTObtainRunningLicenseRecord
AMTPlugPlugRequest
AMTPreObtainProductLicense
AMTPreValidateProductLicense
AMTRecordCodecInvocation
AMTReleaseProductLicense
AMTRetrieveAdobeID
AMTRetrieveLibraryPath
AMTRetrievePersonGUIDWithAuthSource
AMTValidateProductLicense
GetAsnVersion
asnInst_InstallerProductInfo_constructor
asnInst_getAsnProductInfo
asnInst_getAsnProductInfoInMem
asn_exit
asn_info
asn_init
asn_makePrivate
asn_makePrivateEx
free
malloc

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pr0
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f931ee6022f63a8566f4e48ef1231f0

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

shell32

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 5KB - Virtual size: 6KB

.pdata Size: 1024B - Virtual size: 672B

.pr0 Size: 45KB - Virtual size: 44KB

.reloc Size: 512B - Virtual size: 208B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 5KB - Virtual size: 6KB

.pdata
Size: 1024B - Virtual size: 672B

.pr0
Size: 45KB - Virtual size: 44KB

.reloc
Size: 512B - Virtual size: 208B

.rsrc
Size: 1KB - Virtual size: 1KB