agmaw[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

agmaw.exe
Size

348KB
MD5

8ebd96f8fd6cacde60e58a7d8e59c60a
SHA1

6c646b3814445c5b757d906bede340d0c15310a1
SHA256

8cc692c05dea3ae4612ed586eca63f5d79d5d45090a4949d929de77b38b74b07
SHA512

ce932cb133d119d3c47b95b05451e66f46a818833a0bbce43b2a1c8ac66d570ab41a3dd75862a688c968056d74f6a3c9808eddaf495b2e2bc85097e9466ef94b
SSDEEP

6144:UC2PwM1V55XuxLIccrNpIYwsMhssfbYSM2C9ffsBRFF3bB:U9PTzgqHIYwd0SM2CNsBbdt

Score

1^/10

Malware Config

Signatures

Files

agmaw.exe
.exe windows:5 windows x86 arch:x86

61acd5631140038ae65b32f39b650d1f

Code Sign

19:dc:7b:3b:f1:bd:f0:7a:bc:11:18:72:63:dc:a5:aa
Certificate

Issuer

CN=jhjkkkkkkkkkkkkkkkkkkkkkkkkkkkk 8HCvg7MydLhdqbka7gLw165kEEhJzae1wxEFayLsKDydrhCt7eGzI6jpgGkDasG3Eu3e28Dk15tKkhrExDDypdF9IG1xmdGdrk559Acy7nxdjz8nt 9H37Defc5DKnJDallJl1vmywaBud7nediixsqBhz168sbbi3ozFiJa64LvMFrG5EuH7xK2GcgKMep46htKjczGhGLzEja8yDr4 xnEvnC5oueG44BBBFwvtpmwFALC411Hfleuy246I4E85tm4azeEk8ABEtDGmtislEsAeercdjfyADuempLAG1bKuqhehzg r6jA5CuFKb9lsDxIAABtKkq2mbJitCI49rFHKuGf2j2tpklA66oyzF2jDkdrzI AqH jpwvJGf MC4lpMd3pbplvzKBtvrsIpxtiskww vwzvq5uAsB7qq2L7zq6yssEy54IjCMFIfhen3kEBmhF9qtvx1lHvaGrAgkLkM9ndsroBlxrF4kBC3n3eHezsc6pCcoypwLMEABnBa2H751C7eqf189vIgi3kBbhC6Ak5bm8xumoDFKEF8vDAtMdK42c5FBgp mGoE958MyBMqqiJcx1AdsH547tnbgL8jvGI7flHFwIhDqLkoK99jGxh8sKkwunnffDxefDG6g375oJ9MeH2A1IIJkygJCecg6DL41jk 2Mghoho3C6IpLBsdjkCrzBqyvH1F88qjClvLIh iMw14laGyrilIxakiKK 4uMtBFqCBmFxz585yLdvmDrCHbJ4A7FlEgjrEIm5wK2Ed941bo Id76b9fchwcoi79CKucC9bjaGGluMtJjKoeDHagqol8JDq499lx9b77st7olJKceJLm3wzdeo4fqCoEnI4t7J 5hbFJa4iuvdAtzmiudgCJJMgFi72aiL8Epkwo82 o6qLAiKckv57Cd42 2EA4Abj2kejyd4vz1x63J3rcBqCqccxcMaxv9le856uAGEmssbskfuxLL4pmbdJHr8BHrboz85gk 4qCDozMLcM6w4eod8gHcbjnGgKMM1bih3KfGtao4p2jak5jjkvkCbdaq1qyz9vH4 zobjwydqcqDgd mjs2Bxry yGa7kp6uk7Ehrhcp2wouGl cy5izH5iL2gajJoCF2g6xpMuj6LCG73cpoLCc5g2G4Izqy 8b2Ep o4fv3Hf13k26Kw99CDge8cd8sy cnEHKoi6B5 fmuLi1kjBonkvpm6BlBlrGbpJ6f638pdekClFvcynaA3eaLHjv7lMrv 3 o2z xAJcdfz7 Dhw7B66CiyfEshpv1xwkfclj8dCwrlvCAE4oqC1KMswEmrtkwE2LiGyGatGGraJddjH5wgKMcMhbfilkrohyn6BhLvfckJi79Cfvava9jgkzDhpjkiBx3edaLhBy4cfLA2zsxtBitaejIIbjjkprKKw53fzzI257vf AbCjBDw6B5f9y49gvEaF12qtji3w9gwB9ytigADg8Cv2AIzK udb1CvGrcpooumejqcwk8HljJ39BBMIbxMB8n1D7JL9LL41I85 jkgbpknjAJc3Lx47plpyyBFj17hrqpM23guMHxpKerfII2GmebK5fmigczgkB9cxhslMwjxE2ggnMw8bIhhmv7pDH njkICGKa2pux42fz5uj5aoLoiImM4w83DAz ibpnJ9Ii3EdI4zkgGq mCxeFuhr41Ap2jiG5qlG9niKH4j1 noLbqoozhKftDyLwJuy1uvbi5d5iAtyDom A6cLJoAuDu97hvCsDlkGr3Hj56zguajo8eGL8nrcADuscFjMlxH78hJenuton2apo4mMa41drFiEhmzdHojwkqsaqCk4Adw6k3jxFFKCHaH1iGw5Jsnf7joGgK3wEBmvibM7 1eEBnGDwG8K9M7mwD Lj51elEMhduu1Govc4gE9axB79Gpn5p1DhfxvoyjzbE3IiB aaaaaaaaaaaaaaaaaaaaaaaaaa

Not Before

15/01/2013, 05:19

Not After

31/12/2039, 23:59

Subject

CN=jhjkkkkkkkkkkkkkkkkkkkkkkkkkkkk 8HCvg7MydLhdqbka7gLw165kEEhJzae1wxEFayLsKDydrhCt7eGzI6jpgGkDasG3Eu3e28Dk15tKkhrExDDypdF9IG1xmdGdrk559Acy7nxdjz8nt 9H37Defc5DKnJDallJl1vmywaBud7nediixsqBhz168sbbi3ozFiJa64LvMFrG5EuH7xK2GcgKMep46htKjczGhGLzEja8yDr4 xnEvnC5oueG44BBBFwvtpmwFALC411Hfleuy246I4E85tm4azeEk8ABEtDGmtislEsAeercdjfyADuempLAG1bKuqhehzg r6jA5CuFKb9lsDxIAABtKkq2mbJitCI49rFHKuGf2j2tpklA66oyzF2jDkdrzI AqH jpwvJGf MC4lpMd3pbplvzKBtvrsIpxtiskww vwzvq5uAsB7qq2L7zq6yssEy54IjCMFIfhen3kEBmhF9qtvx1lHvaGrAgkLkM9ndsroBlxrF4kBC3n3eHezsc6pCcoypwLMEABnBa2H751C7eqf189vIgi3kBbhC6Ak5bm8xumoDFKEF8vDAtMdK42c5FBgp mGoE958MyBMqqiJcx1AdsH547tnbgL8jvGI7flHFwIhDqLkoK99jGxh8sKkwunnffDxefDG6g375oJ9MeH2A1IIJkygJCecg6DL41jk 2Mghoho3C6IpLBsdjkCrzBqyvH1F88qjClvLIh iMw14laGyrilIxakiKK 4uMtBFqCBmFxz585yLdvmDrCHbJ4A7FlEgjrEIm5wK2Ed941bo Id76b9fchwcoi79CKucC9bjaGGluMtJjKoeDHagqol8JDq499lx9b77st7olJKceJLm3wzdeo4fqCoEnI4t7J 5hbFJa4iuvdAtzmiudgCJJMgFi72aiL8Epkwo82 o6qLAiKckv57Cd42 2EA4Abj2kejyd4vz1x63J3rcBqCqccxcMaxv9le856uAGEmssbskfuxLL4pmbdJHr8BHrboz85gk 4qCDozMLcM6w4eod8gHcbjnGgKMM1bih3KfGtao4p2jak5jjkvkCbdaq1qyz9vH4 zobjwydqcqDgd mjs2Bxry yGa7kp6uk7Ehrhcp2wouGl cy5izH5iL2gajJoCF2g6xpMuj6LCG73cpoLCc5g2G4Izqy 8b2Ep o4fv3Hf13k26Kw99CDge8cd8sy cnEHKoi6B5 fmuLi1kjBonkvpm6BlBlrGbpJ6f638pdekClFvcynaA3eaLHjv7lMrv 3 o2z xAJcdfz7 Dhw7B66CiyfEshpv1xwkfclj8dCwrlvCAE4oqC1KMswEmrtkwE2LiGyGatGGraJddjH5wgKMcMhbfilkrohyn6BhLvfckJi79Cfvava9jgkzDhpjkiBx3edaLhBy4cfLA2zsxtBitaejIIbjjkprKKw53fzzI257vf AbCjBDw6B5f9y49gvEaF12qtji3w9gwB9ytigADg8Cv2AIzK udb1CvGrcpooumejqcwk8HljJ39BBMIbxMB8n1D7JL9LL41I85 jkgbpknjAJc3Lx47plpyyBFj17hrqpM23guMHxpKerfII2GmebK5fmigczgkB9cxhslMwjxE2ggnMw8bIhhmv7pDH njkICGKa2pux42fz5uj5aoLoiImM4w83DAz ibpnJ9Ii3EdI4zkgGq mCxeFuhr41Ap2jiG5qlG9niKH4j1 noLbqoozhKftDyLwJuy1uvbi5d5iAtyDom A6cLJoAuDu97hvCsDlkGr3Hj56zguajo8eGL8nrcADuscFjMlxH78hJenuton2apo4mMa41drFiEhmzdHojwkqsaqCk4Adw6k3jxFFKCHaH1iGw5Jsnf7joGgK3wEBmvibM7 1eEBnGDwG8K9M7mwD Lj51elEMhduu1Govc4gE9axB79Gpn5p1DhfxvoyjzbE3IiB aaaaaaaaaaaaaaaaaaaaaaaaaa

Extended Key Usages

ExtKeyUsageCodeSigning

8c:06:09:d9:2d:21:1c:59:22:c8:49:1b:5f:ef:f2:49:01:c3:b8:50
Signer

Actual PE Digest

8c:06:09:d9:2d:21:1c:59:22:c8:49:1b:5f:ef:f2:49:01:c3:b8:50

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryExA
ReadFile
VirtualAllocEx
CloseHandle
CreateThread
ExitProcess
FileTimeToDosDateTime
FileTimeToLocalFileTime
FormatMessageA
GetCurrentProcess
GetModuleFileNameA
LocalAlloc
LocalFree
SetCurrentDirectoryA
SetErrorMode
SetFilePointer

user32

LoadIconW
LoadCursorA

msvcrt

memset
_XcptFilter
__p__commode
__p__fmode
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_adjust_fdiv
_c_exit
_cexit
_controlfp
_except_handler3
_exit
_ftol
_initterm
_ltow
_wcslwr
_wfopen
_wfullpath
_wsplitpath
exit
fclose
floor
fwprintf
swprintf
wcsncpy
wcsstr

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text7
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text6
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text5
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text4
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text3
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text2
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

61acd5631140038ae65b32f39b650d1f

Code Sign

19:dc:7b:3b:f1:bd:f0:7a:bc:11:18:72:63:dc:a5:aaCertificate

Extended Key Usages

8c:06:09:d9:2d:21:1c:59:22:c8:49:1b:5f:ef:f2:49:01:c3:b8:50Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcrt

Sections

.text Size: 16KB - Virtual size: 15KB

.text7 Size: 512B - Virtual size: 100B

.text6 Size: 512B - Virtual size: 100B

.text5 Size: 512B - Virtual size: 100B

.text4 Size: 512B - Virtual size: 100B

.text3 Size: 512B - Virtual size: 100B

.text2 Size: 512B - Virtual size: 100B

.data Size: 275KB - Virtual size: 274KB

.rsrc Size: 41KB - Virtual size: 40KB

19:dc:7b:3b:f1:bd:f0:7a:bc:11:18:72:63:dc:a5:aa
Certificate

8c:06:09:d9:2d:21:1c:59:22:c8:49:1b:5f:ef:f2:49:01:c3:b8:50
Signer

.text
Size: 16KB - Virtual size: 15KB

.text7
Size: 512B - Virtual size: 100B

.text6
Size: 512B - Virtual size: 100B

.text5
Size: 512B - Virtual size: 100B

.text4
Size: 512B - Virtual size: 100B

.text3
Size: 512B - Virtual size: 100B

.text2
Size: 512B - Virtual size: 100B

.data
Size: 275KB - Virtual size: 274KB

.rsrc
Size: 41KB - Virtual size: 40KB