amtlib[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

amtlib.dll
Size

2.8MB
MD5

c1ef4c1f18a25cb94391c4ded442614c
SHA1

b3c9d99e1f911424ee9dc240b89fb4117f5cbcc0
SHA256

24668ad9ab485cf1b2ff09ece5756f6a7c214d87034ad50c69b18f6605e5d73b
SHA512

114f1dd0da2905b0e0c5cc982d888afc39eeb34aeb1caf0625b389d830daccf8a6546e70a6805147dbaa7c0a20f825cec5593b05b25dc6906d68889bf178d838
SSDEEP

49152:WUHW65Z0y1lkd6KQ1G4fG8kqXI8RTMFTwuizn:WdUz1lkCsuDJn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
amtlib.dll

Files

amtlib.dll
.dll windows:6 windows x64 arch:x64

ba160dbfc8a462a74e895cb414579607

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

amtlib.pdb

Imports

iphlpapi

GetIfTable

winhttp

WinHttpOpenRequest
WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetStatusCallback
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpSetCredentials
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdW
CM_Get_DevNode_Status

shlwapi

PathRemoveFileSpecW
PathFindFileNameW
PathRenameExtensionW
PathIsDirectoryW
PathAppendW
PathIsFileSpecW
PathAddExtensionW
PathRemoveExtensionW
PathFileExistsW

kernel32

ExitProcess
MoveFileExW
GetFileAttributesExW
TzSpecificLocalTimeToSystemTime
SetFileTime
FileTimeToSystemTime
GetCurrentProcess
GetCurrentThread
GetLastError
CloseHandle
FreeLibrary
GetProcAddress
LocalFree
SetLastError
FormatMessageW
LoadLibraryW
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleFileNameW
GetEnvironmentVariableA
WideCharToMultiByte
LockFileEx
UnlockFileEx
GetFileSize
WriteFile
ReadFile
SetEndOfFile
SetFilePointer
GetSystemTime
SystemTimeToFileTime
CreateFileW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetComputerNameExW
MultiByteToWideChar
GetTempPathW
GetLocalTime
GetModuleHandleExW
GetDateFormatW
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ReleaseSemaphore
WaitForSingleObject
GetTickCount
OpenEventW
CreateSemaphoreW
GetTimeZoneInformation
GetVersionExW
OutputDebugStringA
TryEnterCriticalSection
GetCurrentThreadId
SwitchToThread
ResumeThread
GetFileSizeEx
CreateMutexW
ReleaseMutex
OpenMutexW
CreateProcessW
Sleep
FindClose
FindFirstFileW
FindNextFileW
GlobalFree
WaitForMultipleObjects
CreateEventW
CreateDirectoryW
LocalAlloc
IsDBCSLeadByteEx
FlushFileBuffers
WriteConsoleW
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
SystemTimeToTzSpecificLocalTime
GetModuleFileNameA
PeekNamedPipe
GetEnvironmentStringsW
GetFileType
GetDriveTypeW
GetFullPathNameA
GetFullPathNameW
InterlockedFlushSList
InterlockedPushEntrySList
GetTimeFormatW
GetCommandLineW
GetCommandLineA
GetOEMCP
LoadLibraryExW
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
SetConsoleCtrlHandler
GetConsoleCP
SetStdHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFilePointerEx
ReadConsoleW
RtlUnwindEx
RtlPcToFileHeader
OutputDebugStringW
InitializeSListHead
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetStdHandle
GetACP
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
GetStringTypeW
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
ResetEvent

user32

MessageBoxW
UnregisterClassW
wsprintfW

advapi32

OpenProcessToken
RegQueryValueExA
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyA
RegDeleteKeyW
SetSecurityInfo
SetNamedSecurityInfoW
GetNamedSecurityInfoW
CreateWellKnownSid
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
SetTokenInformation
SetEntriesInAclW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetUserNameW
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenThreadToken
SystemFunction036

shell32

ShellExecuteA
SHCreateDirectoryExW
SHGetFolderPathW

ole32

CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoUninitialize

oleaut32

CreateErrorInfo
SetErrorInfo
VariantChangeType
VariantInit
GetErrorInfo
VariantClear
SysAllocStringByteLen
SysStringLen
SysAllocString
SysFreeString

Exports

Exports

AMTGetCurrentLicenseState
AMTGetLibVersion
AMTGetParentLEIDLicenseStatus
AMTGetProductClearSerialNumber
AMTGetRoyaltyBearingLEIDs
AMTObtainProductLicense
AMTObtainRunningLicenseRecord
AMTPlugPlugRequest
AMTPreObtainProductLicense
AMTPreValidateProductLicense
AMTRecordCodecInvocation
AMTReleaseProductLicense
AMTRetrieveAdobeID
AMTRetrieveLibraryPath
AMTRetrievePersonGUIDWithAuthSource
AMTValidateProductLicense
GetAsnVersion
asnInst_InstallerProductInfo_constructor
asnInst_getAsnProductInfo
asnInst_getAsnProductInfoInMem
asn_exit
asn_info
asn_init
asn_makePrivate
asn_makePrivateEx

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 592KB - Virtual size: 591KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba160dbfc8a462a74e895cb414579607

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

iphlpapi

winhttp

setupapi

shlwapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 592KB - Virtual size: 591KB

.data Size: 37KB - Virtual size: 62KB

.pdata Size: 110KB - Virtual size: 109KB

.gfids Size: 2KB - Virtual size: 1KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 592KB - Virtual size: 591KB

.data
Size: 37KB - Virtual size: 62KB

.pdata
Size: 110KB - Virtual size: 109KB

.gfids
Size: 2KB - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 9KB