am[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
am.exe
Size 8.1MB
Sample240403-he7qcaab9t
SHA256 5fa605bf9666dc9486a83737d1f77e241bb27a033e609625499f17dbf608e840
MD5 31fd3d2bdee0fd45c35273bebe4907fa
SHA1 e464d8d3e5a16c0484ecb40e0599a3b4ad1e3f21
SHA512 5a5558811d5a167db43a0a96679f253c3692921e59bc61708a66f6f55458441bb3c3bdc24896eefabd5f2edfb6c87b87be520bd8abd29b0428d831d24ae947b9
SSDEEP 196608:Z0SPWFEHfuhw52hhflik2kYrq/d/wNHP7as4v:Zgqfuhw0hmZry4NesG
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

am.exe

.exe 8.1MB

am.exe

IMPHASH 4cdb28bb127d72a9bdbe2baa89ad4456
SHA256 5fa605bf9666dc9486a83737d1f77e241bb27a033e609625499f17dbf608e840
MD5 31fd3d2bdee0fd45c35273bebe4907fa
SHA1 e464d8d3e5a16c0484ecb40e0599a3b4ad1e3f21
SHA512 5a5558811d5a167db43a0a96679f253c3692921e59bc61708a66f6f55458441bb3c3bdc24896eefabd5f2edfb6c87b87be520bd8abd29b0428d831d24ae947b9
SSDEEP 196608:Z0SPWFEHfuhw52hhflik2kYrq/d/wNHP7as4v:Zgqfuhw0hmZry4NesG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

a2:e7:96:44:f4:84:c6:eb:75:df:de:85:03:6e:af:6c:07:74:18:08:30:bf:0d:45:6f:45:57:2c:09:ee:26:86

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Cisco Systems\, Inc.,O=Cisco Systems\, Inc.,L=Milpitas,ST=California,C=US

Chains

Aug 24, 2022

Minor OS version

Major OS version

Entry point

1199487

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\build.tc\agent\work\be4aeed6d8977370\lpchrome\nplastpass\native_messaging Release\nplastpass.pdb

crypt32

CryptUnprotectData CryptProtectData

oleacc

AccessibleChildren AccessibleObjectFromWindow

kernel32

GetFileAttributesA GetCurrentProcessId GetTempPathA CreateProcessW CompareFileTime CreateDirectoryW WriteFile GetSystemDirectoryW GetExitCodeProcess ReadFile CreateFileW GetTempPathW GetFileTime CloseHandle GetWindowsDirectoryW DeleteFileW CreateThread GetCommandLineW GetTempFileNameW CopyFileA GetShortPathNameW DeleteFileA GetFullPathNameW GetFullPathNameA CreateFileA GetFileSize HeapCompact SetFilePointer TryEnterCriticalSection MapViewOfFile UnmapViewOfFile SetEndOfFile SystemTimeToFileTime QueryPerformanceCounter InterlockedCompareExchange UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx OutputDebugStringW UnlockFileEx GetSystemTimeAsFileTime FormatMessageA FormatMessageW HeapCreate HeapValidate FlushFileBuffers LockFileEx GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW OutputDebugStringA GetVersionExA GetSystemTime AreFileApisANSI SetUnhandledExceptionFilter GetCurrentThread SizeofResource ConnectNamedPipe CreateNamedPipeW WaitNamedPipeW TerminateThread DisconnectNamedPipe ProcessIdToSessionId GetExitCodeThread SetNamedPipeHandleState OpenFileMappingW ReleaseMutex LocalFree OpenProcess Process32FirstW Process32NextW CreateToolhelp32Snapshot LocalAlloc QueryPerformanceFrequency GetThreadTimes QueryDepthSList InterlockedFlushSList ReleaseSemaphore DuplicateHandle VirtualProtect GetModuleHandleA FreeLibraryAndExitThread FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA SetStdHandle ReadConsoleW GetOEMCP GetACP IsValidCodePage GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW CreateSemaphoreW GetStartupInfoW TerminateProcess CreateEventW UnhandledExceptionFilter UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber GetModuleHandleW DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer SetEnvironmentVariableA GetLogicalProcessorInformation TlsFree TlsSetValue TlsGetValue TlsAlloc GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait SetEvent CreateTimerQueue GetCPInfo RtlUnwind GetCommandLineA GetModuleHandleExW ExitProcess GetTimeZoneInformation FindNextFileW GetCurrentDirectoryW Sleep InitializeCriticalSection GetTickCount FindFirstFileW GetFileAttributesW GetVersionExW DebugBreak FreeLibrary WaitForSingleObject CreateMutexW GetCurrentThreadId GlobalHandle LockResource GlobalFree EnterCriticalSection GetProcAddress SetLastError FlushInstructionCache GlobalUnlock lstrcmpW GetModuleFileNameW MulDiv LeaveCriticalSection LoadLibraryW GlobalAlloc GlobalLock GetCurrentProcess InterlockedDecrement InterlockedIncrement LoadResource FindResourceW MultiByteToWideChar WideCharToMultiByte DeleteCriticalSection DecodePointer HeapSize GetLastError RaiseException HeapDestroy InitializeCriticalSectionAndSpinCount GetProcessHeap HeapFree HeapAlloc HeapReAlloc UnregisterWaitEx WriteConsoleW IsDebuggerPresent LoadLibraryExW ExitThread VirtualFree VirtualAlloc IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer GetStringTypeW

user32

SetWindowTextW SendMessageW SetDlgItemTextW ReleaseCapture CreateWindowExW CallWindowProcW DefWindowProcW GetWindow MoveWindow UnregisterClassW ClientToScreen SetTimer KillTimer GetClipboardData CloseClipboard SetClipboardData EmptyClipboard FindWindowExW GetForegroundWindow OpenClipboard LoadStringW GetLastInputInfo MessageBoxW MapDialogRect SetWindowContextHelpId SendDlgItemMessageW EndPaint DestroyWindow GetWindowTextLengthW DestroyAcceleratorTable ScreenToClient CharNextW RegisterWindowMessageW FillRect IsChild SetCapture DialogBoxIndirectParamW GetFocus GetParent InvalidateRgn LoadCursorW GetClientRect CreateAcceleratorTableW SetFocus BeginPaint GetClassInfoExW GetDC RegisterClassExW InvalidateRect GetWindowLongW GetWindowTextW GetClassNameW ReleaseDC GetDlgItem SetWindowLongW EndDialog RedrawWindow GetDesktopWindow GetSysColor SetWindowPos ShowWindow GetActiveWindow IsWindow

gdi32

DeleteDC GetDeviceCaps DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap GetObjectW GetStockObject CreateSolidBrush BitBlt

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

CryptAcquireContextW CryptReleaseContext CryptAcquireContextA ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityInfo GetAce SetSecurityDescriptorDacl InitializeSecurityDescriptor RevertToSelf ImpersonateLoggedOnUser GetUserNameW SetNamedSecurityInfoW AdjustTokenPrivileges LookupPrivilegeValueW OpenThreadToken RegCloseKey GetLengthSid RegOpenKeyExW RegQueryValueExW CopySid GetTokenInformation OpenProcessToken CryptGenRandom

shell32

SHGetFolderPathW CommandLineToArgvW ShellExecuteExW ShellExecuteW

ole32

CoCreateInstance OleLockRunning CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal CoInitialize CoUninitialize CoTaskMemAlloc CoGetClassObject CoTaskMemFree OleUninitialize OleInitialize StringFromGUID2

oleaut32

OleCreateFontIndirect SysStringByteLen LoadRegTypeLi SysFreeString SysAllocStringLen VariantInit SysAllocString SysStringLen VariantClear LoadTypeLi