ampa[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

ampa.exe
Size

2.1MB
MD5

420d61a209f8867bc4ea8960a0c66d8e
SHA1

067a3b2e27075d9b095a82f9a7e183939eb3ce2e
SHA256

167ebcd3864dfe01aa44b4b26aa579bff2f1099776c3a9860fe87d99d19c1d69
SHA512

d4ad1822dbe59ab08c169497c6842acddaeb6a401105ad68f621488505acb3353ee6de723021e13619cb8a05d70bf1bb13d07ab7ee027da04c21908704f4b3d4
SSDEEP

49152:MB/23GBaFjWlb8Tg4AxxSYKDiCYWnC3itWNp2VRLyJallKM9Cf36IoRQ32bimu4/:PNSl

Score

1^/10

Malware Config

Signatures

Files

ampa.exe
.sys windows:6 windows x64 arch:x64

c0b3cecd20e42ef0f9980814abeff531

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

28:73:6d:0d:29:67:89:51:2b:ac:66:cc:e8:6c:4a:00
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

29-06-2016 00:00

Not After

29-06-2019 23:59

Subject

CN=CHENGDU AOMEI Tech Co.\, Ltd.,O=CHENGDU AOMEI Tech Co.\, Ltd.,L=ChengDu,ST=SiChuan,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:24:5f:95:fc:68:b4:67:3b:7d:53:20:c0:cc:99:2f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

21-09-2016 00:00

Not After

21-09-2019 23:59

Subject

CN=CHENGDU AOMEI Tech Co.\, Ltd.,O=CHENGDU AOMEI Tech Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

42:c7:3f:31:cd:ac:b7:78:0f:43:4f:d4:31:04:4b:8a:03:a8:ad:b9:60:81:d9:3c:39:53:15:b2:e2:49:14:39
Signer

Actual PE Digest

42:c7:3f:31:cd:ac:b7:78:0f:43:4f:d4:31:04:4b:8a:03:a8:ad:b9:60:81:d9:3c:39:53:15:b2:e2:49:14:39

Digest Algorithm

sha256

PE Digest Matches

true

bb:31:cd:30:3b:75:55:20:94:c5:f1:45:11:69:4b:63:e6:67:80:81
Signer

Actual PE Digest

bb:31:cd:30:3b:75:55:20:94:c5:f1:45:11:69:4b:63:e6:67:80:81

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

z:\mrp\preos\native\objfre_wlh_amd64\amd64\ampa.pdb

Imports

ntdll

_wtoi
strrchr
swprintf
sprintf
wcsstr
strncpy
wcsncmp
wcsncpy
DbgBreakPoint
ZwTerminateProcess
RtlFreeHeap
RtlAllocateHeap
ZwQuerySystemTime
ZwMakeTemporaryObject
ZwCreateFile
RtlInitUnicodeString
ZwQueryInformationProcess
ZwWaitForMultipleObjects
ZwSetInformationProcess
ZwSetThreadExecutionState
ZwClose
ZwQuerySystemInformation
ZwCreateEvent
NtLoadDriver
ZwShutdownSystem
ZwOpenProcessToken
ZwOpenSymbolicLinkObject
ZwLockVirtualMemory
ZwAdjustPrivilegesToken
NtUnloadDriver
ZwDeleteFile
ZwInitializeRegistry
ZwQuerySymbolicLinkObject
RtlDosPathNameToNtPathName_U
_strlwr
ZwReadFile
strstr
NtTerminateProcess
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlNormalizeProcessParams
ZwQueryAttributesFile
ZwSetInformationFile
RtlFreeUnicodeString
RtlNtStatusToDosError
ZwFlushBuffersFile
ZwDeviceIoControlFile
ZwOpenFile
ZwQueryInformationFile
ZwWriteFile
ZwFsControlFile
toupper
wcstombs
RtlGetFullPathName_U
ZwDelayExecution
RtlAnsiStringToUnicodeString
ZwAllocateVirtualMemory
RtlSystemTimeToLocalTime
RtlInitAnsiString
RtlGetVersion
RtlTimeFieldsToTime
RtlQueryEnvironmentVariable_U
ZwFreeVirtualMemory
ZwQueryVolumeInformationFile
RtlTimeToTimeFields
ZwDisplayString
vsprintf
ZwUnloadKey
ZwEnumerateKey
ZwCreateKey
RtlOpenCurrentUser
ZwQueryKey
RtlCreateUnicodeString
memmove
ZwOpenKey
ZwDeleteValueKey
ZwSetValueKey
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
wcsrchr
ZwQueryValueKey
ZwEnumerateValueKey
ZwFlushKey
ZwLoadKey
__chkstk
_wcsicmp
_wcsnicmp
ZwQueryDirectoryObject
ZwOpenDirectoryObject
_wcslwr
mbstowcs
memcmp
pow
_wtoi64
strchr
NtQuerySystemTime
strtoul
atoi
NtQueryInformationFile
NtDeviceIoControlFile
NtWriteFile
NtFsControlFile
NtCreateFile
NtClose
NtReadFile
strncmp
RtlTimeToSecondsSince1970
RtlUnicodeStringToOemString
NtQueryDirectoryFile
RtlDeleteCriticalSection
RtlLeaveCriticalSection
RtlCompareMemory
NtOpenFile
RtlInitializeCriticalSection
RtlIsDosDeviceName_U
RtlEnterCriticalSection

Exports

Exports

FormatExtFs

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c0b3cecd20e42ef0f9980814abeff531

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

28:73:6d:0d:29:67:89:51:2b:ac:66:cc:e8:6c:4a:00Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

2d:24:5f:95:fc:68:b4:67:3b:7d:53:20:c0:cc:99:2fCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

42:c7:3f:31:cd:ac:b7:78:0f:43:4f:d4:31:04:4b:8a:03:a8:ad:b9:60:81:d9:3c:39:53:15:b2:e2:49:14:39Signer

bb:31:cd:30:3b:75:55:20:94:c5:f1:45:11:69:4b:63:e6:67:80:81Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.data Size: 45KB - Virtual size: 109KB

.pdata Size: 30KB - Virtual size: 29KB

.reloc Size: 7KB - Virtual size: 6KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

28:73:6d:0d:29:67:89:51:2b:ac:66:cc:e8:6c:4a:00
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

2d:24:5f:95:fc:68:b4:67:3b:7d:53:20:c0:cc:99:2f
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

42:c7:3f:31:cd:ac:b7:78:0f:43:4f:d4:31:04:4b:8a:03:a8:ad:b9:60:81:d9:3c:39:53:15:b2:e2:49:14:39
Signer

bb:31:cd:30:3b:75:55:20:94:c5:f1:45:11:69:4b:63:e6:67:80:81
Signer

.text
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 45KB - Virtual size: 109KB

.pdata
Size: 30KB - Virtual size: 29KB

.reloc
Size: 7KB - Virtual size: 6KB