amtlib[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

amtlib.dll
Size

2.2MB
MD5

6f36524837a57bf7410d956f47ed27d7
SHA1

c742256d88b1ee6bc88ae1ea39aef91f82b6e05d
SHA256

4bd008ee54257d6abd201159c7021b8e13ba5c527eedfe468ece94406b34ad51
SHA512

2ca86937df7c337bc9f0d8c49c6b283c49f0f4e4fcd9ffe553eedce3af751dfe5a6fac34944b4a183180b6274b8c180592c2678592055e36691e8507a9c348a4
SSDEEP

49152:zz+vt/CrWmAfXH2WrdCrXGwsyWXu/WCxR9zqFAKR2g+sA0jeQt1Hw:kt/CrW9XHDHAFD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
amtlib.dll

Files

amtlib.dll
.dll windows:6 windows x86

d2c3897f0a61ede99f4aeda010eeb1eb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

iphlpapi

GetIfTable

winhttp

WinHttpQueryDataAvailable
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpSetCredentials
WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpReceiveResponse
WinHttpSetStatusCallback
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest

setupapi

SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status
SetupDiGetDeviceInstanceIdW

shlwapi

PathIsFileSpecW
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
PathRemoveExtensionW
PathAddExtensionW
PathAppendW
PathIsDirectoryW
PathRenameExtensionW

kernel32

GetUserDefaultLCID
IsValidLocale
GetStdHandle
GetACP
GetModuleFileNameA
GetModuleHandleExW
GetCurrentProcess
GetCurrentThread
GetLastError
CloseHandle
FreeLibrary
GetProcAddress
LocalFree
SetLastError
FormatMessageW
LoadLibraryW
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleFileNameW
GetEnvironmentVariableA
WideCharToMultiByte
LockFileEx
UnlockFileEx
GetFileSize
WriteFile
ReadFile
SetEndOfFile
SetFilePointer
GetSystemTime
SystemTimeToFileTime
CreateFileW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetComputerNameExW
MultiByteToWideChar
GetTempPathW
GetLocalTime
GetTimeFormatW
GetDateFormatW
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ReleaseSemaphore
WaitForSingleObject
GetTickCount
OpenEventW
CreateSemaphoreW
GetTimeZoneInformation
GetVersionExW
OutputDebugStringA
TryEnterCriticalSection
GetCurrentThreadId
SwitchToThread
ResumeThread
GetFileSizeEx
CreateMutexW
ReleaseMutex
OpenMutexW
CreateProcessW
FindClose
FindFirstFileW
FindNextFileW
GlobalFree
WaitForMultipleObjects
CreateEventW
CreateDirectoryW
LocalAlloc
IsDBCSLeadByteEx
FlushFileBuffers
ExitProcess
MoveFileExW
TzSpecificLocalTimeToSystemTime
SetFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
InterlockedPushEntrySList
WriteConsoleW
LoadLibraryExW
RtlUnwind
OutputDebugStringW
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetFileType
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
SetConsoleCtrlHandler
GetConsoleCP
SetStdHandle
GetDriveTypeW
GetFileAttributesExW
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStringTypeW
EncodePointer
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
InterlockedFlushSList

user32

UnregisterClassW
wsprintfW
MessageBoxW

advapi32

SystemFunction036
RegQueryValueExA
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyA
RegDeleteKeyW
SetSecurityInfo
SetNamedSecurityInfoW
GetNamedSecurityInfoW
CreateWellKnownSid
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
OpenThreadToken
SetTokenInformation
SetEntriesInAclW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetUserNameW
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken

shell32

SHGetFolderPathW
SHCreateDirectoryExW
ShellExecuteA

ole32

CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoUninitialize

oleaut32

CreateErrorInfo
SetErrorInfo
VariantChangeType
VariantInit
GetErrorInfo
VariantClear
SysAllocStringByteLen
SysStringLen
SysAllocString
SysFreeString

Exports

Exports

AMTGetCurrentLicenseState
AMTGetLibVersion
AMTGetParentLEIDLicenseStatus
AMTGetProductClearSerialNumber
AMTGetRoyaltyBearingLEIDs
AMTGetSerialExpiryDate
AMTObtainProductLicense
AMTObtainRunningLicenseRecord
AMTPlugPlugRequest
AMTPreObtainProductLicense
AMTPreValidateProductLicense
AMTRecordCodecInvocation
AMTReleaseProductLicense
AMTRetrieveAdobeID
AMTRetrieveLibraryPath
AMTRetrievePersonGUIDWithAuthSource
AMTValidateProductLicense
GetAsnVersion
asnInst_InstallerProductInfo_constructor
asnInst_getAsnProductInfo
asnInst_getAsnProductInfoInMem
asn_exit
asn_info
asn_init
asn_makePrivate
asn_makePrivateEx

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 305KB - Virtual size: 305KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2c3897f0a61ede99f4aeda010eeb1eb

Headers

DLL Characteristics

File Characteristics

Imports

iphlpapi

winhttp

setupapi

shlwapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 305KB - Virtual size: 305KB

.data Size: 28KB - Virtual size: 49KB

.gfids Size: 2KB - Virtual size: 1KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 76KB - Virtual size: 75KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 305KB - Virtual size: 305KB

.data
Size: 28KB - Virtual size: 49KB

.gfids
Size: 2KB - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 76KB - Virtual size: 75KB