amidewinx64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

amidewinx64.exe
Size

407KB
MD5

8cddc9c5a48de1f43a5c8bbcc55488cf
SHA1

ef0930c7f383ccf307a363fa990331daff589bb6
SHA256

07b329f4d5c815b8f5387e9a064db97734dd82201ae8c58a8e0a858f674aff55
SHA512

609baca75dfb56190b619e5db45a3fdecb4e91190176cb8a03718b1e7999964556f45671977f732908ccdde116066afbfea3c48fd678617cb397b14fa34874be
SSDEEP

6144:3ukCae/ZR9cfRz7l7cYjxY3XFi0iEy8quGJ3WEJxEF1HNw86O:3ukCae/2fR/lAYjxQFikomEar

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
amidewinx64.exe

Files

amidewinx64.exe
.exe windows:5 windows x64 arch:x64

0ee26c64077262ad1196164faba874b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
RegisterClassExA
ExitWindowsEx
BlockInput
SystemParametersInfoA
wsprintfA
MessageBoxA

kernel32

Sleep
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExA
SetThreadExecutionState
GetLastError
CreateMutexA
SetConsoleCtrlHandler
GetCurrentProcess
DeleteFileA
GetCurrentDirectoryA
GetModuleFileNameA
GetModuleHandleA
CloseHandle
DeviceIoControl
GetWindowsDirectoryA
GetSystemDirectoryA
CreateThread
LocalFree
CreateNamedPipeA
WriteFile
ReadFile
SetEndOfFile
GetProcessHeap
CompareStringA
CompareStringW
SetEnvironmentVariableA
ReadConsoleInputA
SetConsoleMode
CreateFileA
RtlVirtualUnwind
GetLocaleInfoA
EnterCriticalSection
LeaveCriticalSection
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetModuleHandleW
ExitProcess
HeapFree
HeapAlloc
GetCommandLineA
RaiseException
RtlPcToFileHeader
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
RtlUnwindEx
DeleteCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
MultiByteToWideChar
LCMapStringW
InitializeCriticalSectionAndSpinCount
HeapSetInformation
HeapCreate
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
HeapReAlloc
GetStringTypeA
GetStringTypeW

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
OpenSCManagerA
DeleteService
ControlService
OpenServiceA
StartServiceA
CreateServiceA
CloseServiceHandle
OpenProcessToken

shell32

ShellExecuteA

Sections

.text
Size: 238KB - Virtual size: 238KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0ee26c64077262ad1196164faba874b8

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

advapi32

shell32

Sections

.text Size: 238KB - Virtual size: 238KB

.rdata Size: 95KB - Virtual size: 94KB

.data Size: 62KB - Virtual size: 100KB

.pdata Size: 10KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 432B

.text
Size: 238KB - Virtual size: 238KB

.rdata
Size: 95KB - Virtual size: 94KB

.data
Size: 62KB - Virtual size: 100KB

.pdata
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 432B