AMSilence[.]7z

Sharing

Copy URL Twitter E-mail

General

Target

AMSilence.7z
Size

477KB
MD5

a8272eeafe01c71a694b9e8249799150
SHA1

92aee557f1dcf4a895fe6f58c2e8dcf23ac426be
SHA256

64dc5ddaf556bc19e431bc5d1f6cf3e1ba8369aa74cd0a4636daa38c7bb21fa0
SHA512

20863cb884175a67a39fbbd17625dfcbf5836bc4d20a7ad22367fe2b60567fdcf207c463b347b01be97ea8ef8ebb77f14525eecf32a37b9195285c2281205ae3
SSDEEP

12288:D5V3ZR7SEH1B6jwSwO7DX5e0RQrRwDvZqOLYIrE:DL3ZFlb6jwSwG5edrRaYnqE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/AMSilence.exe

Files

AMSilence.7z
.7z

Password: infected
AMSilence.exe
.exe windows:6 windows x64 arch:x64

Password: infected

713f980123de048d641045be7023cbde

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

AMSilence.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressSingle
WakeByAddressAll

kernel32

GetCurrentProcessId
CreateNamedPipeW
SetThreadStackGuarantee
GetCurrentThread
WriteFileEx
SleepEx
ReadFileEx
WaitForMultipleObjects
GetOverlappedResult
UpdateProcThreadAttribute
CreateEventW
CancelIo
ReadFile
HeapAlloc
GetProcessHeap
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
RtlVirtualUnwind
WideCharToMultiByte
LoadLibraryExA
InitializeProcThreadAttributeList
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
CreateThread
DuplicateHandle
GetFileAttributesW
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
CompareStringOrdinal
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileInformationByHandleEx
GetFileInformationByHandle
GetFullPathNameW
IsDebuggerPresent
SetFileInformationByHandle
CreateFileW
GetTempPathW
GetEnvironmentVariableW
lstrlenW
FormatMessageW
SetLastError
GetProcAddress
WriteConsoleW
MultiByteToWideChar
UnhandledExceptionFilter
WaitForSingleObject
SetUnhandledExceptionFilter
GetConsoleMode
GetStdHandle
HeapReAlloc
FindNextFileW
FindClose
FindFirstFileW
LoadLibraryW
GetModuleHandleA
GetCurrentProcess
Module32NextW
GetModuleHandleW
Module32FirstW
CreateToolhelp32Snapshot
GetModuleFileNameW
OutputDebugStringW
GetLastError
CloseHandle
HeapFree
DeleteProcThreadAttributeList
GetExitCodeProcess
IsProcessorFeaturePresent

oleaut32

SysStringLen
GetErrorInfo
SysFreeString

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SystemFunction036

bcrypt

BCryptGenRandom

ntdll

NtWriteFile
RtlNtStatusToDosError
NtReadFile

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

vcruntime140

memmove
memset
memcmp
__C_specific_handler
memcpy
__current_exception_context
__current_exception
__CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_c_exit
__p___argc
terminate
_exit
_cexit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
exit
_set_app_type
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_crt_atexit
_initialize_onexit_table
_register_onexit_function
__p___argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 507KB - Virtual size: 506KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

713f980123de048d641045be7023cbde

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

oleaut32

advapi32

bcrypt

ntdll

api-ms-win-core-winrt-error-l1-1-0

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 507KB - Virtual size: 506KB

.data Size: 512B - Virtual size: 800B

.pdata Size: 18KB - Virtual size: 18KB

.reloc Size: 16KB - Virtual size: 16KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 507KB - Virtual size: 506KB

.data
Size: 512B - Virtual size: 800B

.pdata
Size: 18KB - Virtual size: 18KB

.reloc
Size: 16KB - Virtual size: 16KB