Amazon Workspaces[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Amazon Workspaces.exe
Size 3.1MB
Sample230512-lbbqaace65
SHA256 42f76f37742103bd599a68ef508b515efeb9e9ffddbfdcc43eb552b70b2440e9
MD5 3ef1892c1a5f1bb056871b7d7e5cd69a
SHA1 08a6ff5c2d443d2bf9facb2a458de2876328061b
SHA512 527172905cbb24923b294027d37f0e3de0190f442b45ba80a04a7640b222ee729558af36ae65c35e43dd2f4af36ea476ee2f94cd2d86f98536536a683e668a4d
SSDEEP 49152:dwG5dutV04/iT5W5pLoJ6qJNPhERaU+d:uGgJNVARX5ERaUc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Amazon Workspaces.exe

File Explorer

Amazon Workspaces.exe

.exe 3.1MB

Amazon Workspaces.exe

IMPHASH bb95a3753c15dcb5321833d4a7448423
SHA256 42f76f37742103bd599a68ef508b515efeb9e9ffddbfdcc43eb552b70b2440e9
MD5 3ef1892c1a5f1bb056871b7d7e5cd69a
SHA1 08a6ff5c2d443d2bf9facb2a458de2876328061b
SHA512 527172905cbb24923b294027d37f0e3de0190f442b45ba80a04a7640b222ee729558af36ae65c35e43dd2f4af36ea476ee2f94cd2d86f98536536a683e668a4d
SSDEEP 49152:dwG5dutV04/iT5W5pLoJ6qJNPhERaU+d:uGgJNVARX5ERaUc
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

497992

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

InitCommonControlsEx ImageList_Destroy ImageList_Create ImageList_ReplaceIcon CreateToolbarEx

kernel32

MultiByteToWideChar LocalFree LoadLibraryA GetProcAddress IsBadReadPtr GetModuleHandleW SetFilePointer LocalAlloc WriteConsoleW ReadFile FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP HeapSize SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA IsValidCodePage FindFirstFileExW GetProcessHeap EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetACP WriteFile GetStdHandle GetModuleHandleExW ExitProcess GetOEMCP GetFileSizeEx WritePrivateProfileStringW GetPrivateProfileIntW GetPrivateProfileStringW CreateDirectoryW FindFirstFileW FindNextFileW RemoveDirectoryW SetFileTime SetErrorMode FindClose CreateFileW GetLogicalDriveStringsW DeleteFileW CloseHandle MoveFileW GetComputerNameW WideCharToMultiByte GetCurrentThreadId GetCurrentProcessId FormatMessageW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection WaitForSingleObject ResumeThread Sleep CreateThread FileTimeToSystemTime FileTimeToLocalFileTime GetLocalTime GetTimeFormatW SystemTimeToFileTime GetDateFormatW FreeResource LockResource LoadResource FindResourceW GetCurrentProcess GetModuleFileNameW GetLastError TerminateProcess CreateEventW SetEvent CreateProcessW GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetCommandLineW FreeLibrary EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx LoadLibraryExW HeapAlloc HeapReAlloc HeapFree

user32

MessageBoxW GetDlgItem LoadBitmapW GetCursorPos SetForegroundWindow RegisterWindowMessageW TrackPopupMenu IsWindowVisible MapVirtualKeyW DestroyIcon GetWindowLongPtrW GetSystemMetrics SendMessageW CallWindowProcW PostMessageW ShowWindow GetActiveWindow EnableWindow GetWindowTextW InvalidateRect SetWindowLongW SetWindowTextW GetWindowLongW DialogBoxParamW LoadIconW IsWindow SetClassLongPtrW EndDialog DestroyWindow CreateDialogParamW EnableMenuItem AppendMenuW CheckMenuItem DestroyMenu SetMenuDefaultItem CreatePopupMenu GetMenuItemCount InsertMenuItemW GetMenuItemID GetSystemMenu CreateWindowExW FillRect ShowScrollBar SetScrollInfo EndPaint BeginPaint GetClientRect ScreenToClient GetParent ReleaseDC GetDC ToUnicodeEx GetKeyboardLayout GetAsyncKeyState GetKeyState LoadAcceleratorsW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetPriorityClipboardFormat SetClipboardViewer PostQuitMessage IsDialogMessageW SystemParametersInfoW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx GetWindowRect SetWindowPos MonitorFromWindow MessageBeep GetWindowPlacement GetMonitorInfoW GetKeyboardLayoutNameW SetWindowPlacement SetFocus LoadCursorW KillTimer GetDesktopWindow IsIconic GetMessageW DefWindowProcW SetWindowLongPtrW UnregisterClassW DispatchMessageW SetTimer RegisterClassW TranslateAcceleratorW TranslateMessage GetSysColorBrush

comdlg32

GetSaveFileNameW

ws2_32

socket send getsockname getpeername listen shutdown select closesocket bind connect __WSAFDIsSet htons htonl recv ioctlsocket setsockopt ntohs ntohl gethostbyname WSAGetLastError WSACleanup accept WSAStartup

netapi32

NetGetJoinInformation NetApiBufferFree

wininet

InternetOpenUrlA InternetOpenA

gdi32

DeleteObject GetDIBits GetCurrentObject CreateDIBSection StretchBlt SetStretchBltMode SelectObject CreateCompatibleDC DeleteDC GetObjectW CreateSolidBrush BitBlt

advapi32

RegCreateKeyW RegQueryValueExW RegOpenKeyExW RegCloseKey RegOpenKeyW RegDeleteValueW RegSetValueExW RegDeleteKeyW RegEnumKeyW

shell32

ShellExecuteW Shell_NotifyIconW CommandLineToArgvW SHGetSpecialFolderPathW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

670KB

Virtual Size

669KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

288KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

572B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ