D:\amphaise\loader\Amphaise_Loader\Release\Amphaise_Loader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
amphaise_loader.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
amphaise_loader.exe
Resource
win10v2004-20240419-en
General
-
Target
amphaise_loader.exe
-
Size
687KB
-
MD5
4bff0837e335a1bb6bb7d1b73fc26af0
-
SHA1
9b07174a050dbaee696858c865b305094b0d21ef
-
SHA256
a54ff09bc2b161a9b7e9466f005282a3a6f18bc485eed11d6911049d3fd94699
-
SHA512
e8ff10ab3baabbaddecb3b58c42d172deeb5d3af02345f8526a91c5d10b00acf5f3a98afabd06c1e70818fb478942574f55d7fe60cf6747b6f35ac4d957453bd
-
SSDEEP
6144:d2GfZxflWspyhYgaGyQDlJ8Qc7/42f8wbhwFvI5Mfe0SxB7i/0HhqOSS86wbms8D:dHbdWQyhw2JLm/1MjgtT9miT+F9TiGU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource amphaise_loader.exe
Files
-
amphaise_loader.exe.exe windows:6 windows x86 arch:x86
ae896835ef3e42630af61f6b87e26cd6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
urlmon
URLDownloadToFileW
kernel32
InitializeCriticalSectionEx
OpenProcess
HeapSize
CreateToolhelp32Snapshot
GetLastError
Process32NextW
GetCurrentThread
LoadLibraryA
Process32FirstW
HeapReAlloc
CloseHandle
HeapAlloc
GetWriteWatch
GetThreadContext
VirtualAllocEx
LocalFree
DeleteCriticalSection
ExitProcess
GetProcessHeap
WideCharToMultiByte
CreateRemoteThread
CreateDirectoryA
IsDebuggerPresent
GetCurrentThreadId
EnterCriticalSection
GetCurrentProcess
VirtualAlloc
SetConsoleTitleA
VirtualFree
HeapFree
WriteProcessMemory
OutputDebugStringW
HeapDestroy
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetSystemTimeAsFileTime
gdi32
AddFontMemResourceEx
advapi32
IsValidSid
OpenProcessToken
ConvertSidToStringSidW
GetLengthSid
GetTokenInformation
CopySid
msvcp140
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?id@?$ctype@D@std@@2V0locale@2@A
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
??Bid@locale@std@@QAEIXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xlength_error@std@@YAXPBD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Incref@facet@locale@std@@UAEXXZ
userenv
UnloadUserProfile
vcruntime140
_CxxThrowException
memcpy
__current_exception
__CxxFrameHandler3
__std_exception_destroy
_except_handler4_common
__current_exception_context
memset
memmove
__std_terminate
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_errno
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_invalid_parameter_noinfo
_controlfp_s
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_resetstkoflw
system
api-ms-win-crt-stdio-l1-1-0
fgetc
fflush
fclose
_fseeki64
fread
fputc
fsetpos
ungetc
_popen
__p__commode
setvbuf
fgetpos
__stdio_common_vsprintf
_set_fmode
fwrite
fgets
_get_stream_buffer_pointers
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
malloc
_recalloc
_callnewh
free
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-math-l1-1-0
_dsign
_dclass
__setusermatherr
api-ms-win-crt-string-l1-1-0
isalpha
islower
_wcsicmp
api-ms-win-crt-convert-l1-1-0
strtoll
strtoull
strtod
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
remove
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_time64
Sections
.text Size: 97KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 428KB - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ