amstream.pdb
Static task
static1
Behavioral task
behavioral1
Sample
amstream.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
amstream.dll
Resource
win10v2004-20240226-en
General
-
Target
amstream.dll
-
Size
78KB
-
MD5
ced0d3906799750a58b1fea7f0149425
-
SHA1
f9dd12bb310c137e4d7dd6afd8be23554829ed68
-
SHA256
331beee62615c661c062235d993f58d54c1602d40b2cde0014166588fd36b2fa
-
SHA512
1cade3a0cdda4bba4c6f3e9825665d580099edd355b44a94cd342d06bf1e3653c9b21b35375253c0310f4b7261eb7a7271d12952d793dee7712e204a37d7873e
-
SSDEEP
1536:/7ndxLQY8/6sF3GNnM/EqyV1QxyhkXUPcy/eBgTR96ieC:/RxLq/622N0JycyJPcETSieC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource amstream.dll
Files
-
amstream.dll.dll regsvr32 windows:6 windows x86 arch:x86
04afdcd20d30881952cfd312348e831d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_vsnwprintf
memcmp
memcpy
??_U@YAPAXI@Z
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
_purecall
??2@YAPAXI@Z
realloc
??3@YAXPAX@Z
??_V@YAXPAX@Z
malloc
free
memset
kernel32
GetLastError
GetProcAddress
EnterCriticalSection
lstrcmpiW
DeleteCriticalSection
GetCurrentThreadId
CloseHandle
lstrcpyW
DisableThreadLibraryCalls
SetEvent
ResetEvent
CreateEventW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
ReleaseSemaphore
CreateSemaphoreW
MulDiv
CreateThread
GetModuleFileNameW
DuplicateHandle
lstrcmpW
MultiByteToWideChar
lstrcpynW
LeaveCriticalSection
HeapDestroy
SizeofResource
LoadLibraryW
InitializeCriticalSection
GetCurrentThread
GetModuleHandleW
WaitForSingleObject
GetCurrentProcess
LoadLibraryExW
LoadResource
FreeLibrary
FindResourceW
QueueUserAPC
user32
IsRectEmpty
CharNextW
advapi32
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegDeleteKeyW
ole32
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
oleaut32
SysFreeString
RegisterTypeLi
VarI4FromStr
LoadTypeLi
ddraw
DirectDrawCreate
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ