am[.]exe | Triage™

resource
am.exe
unpack001/$PLUGINSDIR/nsExec.dll

am.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 064073dcde901f6dc1e933bb5f531670b3506660bc154b197c5230a89489fb4e
MD5 c87f4ce3cb171fedde19b480af96f20a
SHA1 593f6fb058b2185b1e7f21b3c47fec40f97d1494
SHA512 72fc17c51ce794084e237c4a7783ed02074bc584db7ab230d23ede3ba93961047560b63539ad6176a2ad14ba67cf20384e606dd1abde0c3714f73140209f3aee
SSDEEP 24576:6tJWAU5BzwfvNOw8f4UQnnvkAKSKT34BsJ5OmhBLCUc5vYnuO+0QSmnIE46+0f+A:Xt5BUfv0w3UQnnvYV34oHBL6vYn5JQSW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

676KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Election.wav

SHA256 650525b359d3d0ac48eb839f77c8bfcb1a0029617aaaf7b5000c7e5f18969297
MD5 aa8facbc1066215585aa09efed5af8a1
SHA1 ac0ba145796f679fc54ed7bbfc34d654b9466bad
SHA512 d72af5b31f3707d8c0df99dc6b118f7423cb2c4225c26b8f0c5ae33844e684c3f6e9fb8fc610d424ed2319ddde180b6f860f79411338342a04a1bb4f2c1fcacf
SSDEEP 12288:JRySI78qPK+FKEJst4ps7Q/B3x1mhyLCUc5hxYpQDYwvu0b+VapSP:igA/FKTt4ps85rmhyLCUc5IuruK+0pSP
MD5 SHA1 SHA512 SSDEEP

Cancelled

SHA256 693649bf9b8c5906f1428fc65cddb7bd6ba3da5f63ecdab9888696cc5393e67f
MD5 f8ef845bf133a0b925c42bb6eb1db68b
SHA1 679e2a41eafa68edf99dcbcfad6c4137f82c2ded
SHA512 a17237a95d70b65b7fcd89d6347b02a983aa3e1eab142088b816e5b876d753df0dee4516a4aab03612aea602bba3b0a193083bf3abde5ac7e4819ec48e06c40e
SSDEEP 3072:BStjOrOJGGMBwvqXQGYlawwBonasL9jC0O2iSW4QlXUxPrCtTRVBx:BStQOAGlXuww8x1WUyBx
MD5 SHA1 SHA512 SSDEEP

Education

SHA256 9c29fe909a6e7618b8406f5eac4416d324a2f2a5bdc74efadf58083a6a5adab9
MD5 0ba9a43140e5cd3c56228a4e85535d80
SHA1 cb9f8eddb67dd1d2d862957aff14b4a390bd340a
SHA512 4c73c1a76855086aa328122ffc4ba2fb237886e5cab582c3e06e1244d258e59d1f46e5f8506592611c99b0442a2e1a4f97f2067b0c6d74c84012ac9472da6f11
SSDEEP 3072:fDXOXT/CfXib+tSijpcVMFXD5ypAXoegz+:7XOXbCf/1jpcuX0pAI+
MD5 SHA1 SHA512 SSDEEP

Exclusive

SHA256 63988aaafe1dd998066d9af3a7303fb975e342b2b55fb3970689212427fe2bdb
MD5 8596134ab53c8a6cbea17514def3b7f4
SHA1 4c93089bf8323efc85ded210494192ec08c6f309
SHA512 0f89b8fd44b46bffd0e1a1daa140f7c90ea5395ba13ffb77cbd5656b0a25d643684574bf464efdfd1a97f2a92ae0bd4f326276347d8e5d5b2795bc13f48ded05
SSDEEP 3072:OY3I09JwCIj4BPb1XuE/gc0Ag0Fuz08XvBN3j:OY3IW5Iuh0AOz04px
MD5 SHA1 SHA512 SSDEEP

Fashion

SHA256 87303d304337a52176713e5dacc5714b027a932b5e26d5b37e43bf4d1cb344aa
MD5 6cbe78f0fef96720e87752ca71cdc4ca
SHA1 04a199daf367443a329ce4e8daff181f697f25c7
SHA512 464ff577ed634646411eaa2703b19fc632bed9d11104fd306660423fa16f515535a5bb600ec366bad5abcfa3ae56a10a9259f44ae6c07530d1ab62d1077866c3
SSDEEP 1536:jaAwu+1PdJaGloaj6bs8jcd/TcI3s+uXkrfhrRj3:jaAt+1Pfam6OzmkrJrRj
MD5 SHA1 SHA512 SSDEEP

From

SHA256 417f8ff6dfa5411fb00cc4678a6cc5ec23fd685b46250e0aa13d7371967811e1
MD5 79f75acdc392535a1a4523a073ae08fc
SHA1 df290226fa17b2d3f3da393d098a58ac21777c53
SHA512 8f287e9684e6f1ebce43ae9e73f17b4df77654032aef9ab1029f84bc3e3033eb663483c012565b500e5d8215e01f26c50d6fc9e5620d17b60ff9391c3f91ae99
SSDEEP 1536:OYwYwTkNJ3Rpref3ghV1SKOxqNdunCMfpfpJKgMPdkdux845:OeVzOqD1IGuTpMgK/
MD5 SHA1 SHA512 SSDEEP

Lined

SHA256 6823810515137a795a2187173e3b9d872464ffa90cd78ed9627dec8409d2d69e
MD5 1ebe09a4088e108bbf108f837383d791
SHA1 d670f5a4f2ec3e07aed4f3175f2573ceeb74f206
SHA512 3a2e77cbf3ea689a82d50e3aba3f3be7241c2888f18fe0c97028058e5f852c1816d8f8b867289a34e51846e8b871aa8a81e85c61f121029218cbb6d4cd3d2f48
SSDEEP 1536:9NkMoKFHWKbAAnPC2U1Ld/f/Yyiy2ozCt+JQ+HcnkH:9NkdKF0vYNyet+JQ+HcnkH
MD5 SHA1 SHA512 SSDEEP

Lose

SHA256 172c9ed2f853bd70346817b6903192137561a8d67ce01449ece597ab58e63613
MD5 a248adf94e4c82c25dff13cb407c80df
SHA1 6ae21e0fc681eb2252d53562bdf0617e044bbe1a
SHA512 5ed76beaf01de938b7f10f5ad70187198765ceba31d6cb2fa36cdadd4293857f39fee160f5b42aa6271e5935f72afe3296da6dc3aff6ba7459f8c0de24362c5f
SSDEEP 1536:Sh63EYrDWyu0uZo2+9Br+DATG62rt4dP+iX7DjfvSSuyxiQ:Sh6DWy4ZNor+D62rqd2iXbvSS7iQ
MD5 SHA1 SHA512 SSDEEP

Toy

SHA256 56b0ffd034c08c4e2f4c76faeb6db83f21ea2047a4e7438d2220bf3551404731
MD5 906b24f6fd217fe46ce3e43b63bc503d
SHA1 9899d689e744df6906ec4ff68b90e010a32845a2
SHA512 8e241c8e9cd54c8be06b66b918c802a19e35b1461c252f27b61511d6deac2c5a56d3bb1ff5ca83a19eac834de5101e8ab4caef513422f53cd5099260076b52d7
SSDEEP 3072:r8xCSVYvlhx6vA3MD8jjJ8lghHzJi2ubSW4wC2mYR+HE:r8ZUlhxb8AV8lghTM2u3GE
MD5 SHA1 SHA512 SSDEEP

U

SHA256 9336f5c148e3df67b34a48bfdc32dff710bd1c8807b28d13bafd53336bfa8d2f
MD5 1b320ac5cb93477419fe62d6951e8fc1
SHA1 fd43d373dd502b62f88eb41d97467d19fcf90c8d
SHA512 88341b5cd3497f10e8dabe0c0365b6f3d9f5553aec2644f5c312652418cd98172a06e476ca193b6921171ba5cc9f852fd9be19512707f3c4fd9d11187260cdc8
MD5 SHA1 SHA512

Would

SHA256 95e4b52a4d03b0c27bfc1bf3d6972fe00b333a655227849eb95ca7e06cd83259
MD5 19fca270ea36dd9140c8d2b798c40c18
SHA1 893fd1e5adda444dbac1eb6aa8cbec1ff4a9f5e8
SHA512 4f28d5445289af7644cf61ac4ff8dfe6e1253bbe823e62218e95ffc0d2faad86a6a4d7bd75fe7a3aec94a507f7b57b2abd08c4b8b1d68166cfe925b2afdbb281
SSDEEP 1536:wbL8R571Nf0xe5c/IwDXX/44Uu0HkjrkBGCGa:wbwR5Exe2/RTX/4gxRa
MD5 SHA1 SHA512 SSDEEP

$TEMP/Magazine.wav

SHA256 9cb3840fbb0fa9ac0885f4295f529cfa74970aa5f872d673412cf570cdb12085
MD5 9adeebaef64fa44301a09c3381c57516
SHA1 fc7aa4157df230de583f05c4d9aeb3b9a1965d89
SHA512 11a2e6cfecd87491ece78e19e83436a69fb7170bfff0669f425efa2dc97a823239052bc361282a5f19bac8cb935860d1081448b07c8c9b6fafb945b49a29d559
SSDEEP 1536:E+sRy8gIq0S1yBl1gwiOJObunepePzRnWtntyxkivXincsrRgg/NFgpSZcT1fQe:ns+gSUBNPYubRMnak1ncZ8FgEQ
MD5 SHA1 SHA512 SSDEEP

$TEMP/Offline.wav

SHA256 0b7d2c17c5127fbda9aca2823847c512b36aec265abffc66f0616c195352442d
MD5 e23c0e646d31a21297074194ada2ef5c
SHA1 378781515bc5e1722636e89513121e39bef14b21
SHA512 4c1927bc1821fe236a4bbea567c23dd5d57ab218b1be98a7b52c07f9bc1356f0c6100ffb0c33ec7708c358f178d99108677e778b4b0b3f20fe473bcdeb338ca2
SSDEEP 6144:ZAFYULWLvwfpVh5Ztv2pfO+q5GVYuHVvpxt/mfsXxdNPCHDL0lXss:ZmYULWzwfvLZtv2BPjjt3t4DL0l8s
MD5 SHA1 SHA512 SSDEEP

$TEMP/Ready.wav

SHA256 b6892e1a14d022a67b2bd22bc80de2031ae5944ce0054d39c8a956d6e1496e35
MD5 9740911b7f1ad8d93bd3008a806b96a8
SHA1 71b35d1301f251288d597ea986da92e70becbf59
SHA512 17d89166e5e1189017ea9e251cff38d56252993f0a7528250587df0d47921dacba4cc4b3d8c833195af01274927184390a67dcca79947785649f202415986ddf
SSDEEP 384:oBAnOTwiFMpEJ++DgYOu8jZP3f0JSkiHZa73a:oBAncLmEJvkYOXZPPYWHo7q
MD5 SHA1 SHA512 SSDEEP

$TEMP/Sounds.wav

SHA256 34652f3d205db2d09c0468b467d68f69c7925a8e8a924f43361dcf47d7411796
MD5 0d4a552e36407e4d4704cabe05bc75be
SHA1 5f0d7237b977173283d738c7a2cabad61bf897c5
SHA512 3375aefdfe4f09575e5a798cb9baff68512c841bd6998a4673ab00fe89628cb8bd3e876d9ab114988d4f85e79ad9301b17204ee3c9bf7c0cbfbfef82350084c8
SSDEEP 6144:QRePgUO4ieXBtCgZ74l18Zs2pfNRtG1j151A:oIE4tt6862pfNRoVb1A
MD5 SHA1 SHA512 SSDEEP

am.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Election.wav

Cancelled

Education

Exclusive

Fashion

From

Lined

Lose

Toy

U

Would

$TEMP/Magazine.wav

$TEMP/Offline.wav

$TEMP/Ready.wav

$TEMP/Sounds.wav

Sharing

General

Malware Config

Signatures

File Explorer

am.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Election.wav

Cancelled

Education

Exclusive

Fashion

From

Lined

Lose

Toy

U

Would

$TEMP/Magazine.wav

$TEMP/Offline.wav

$TEMP/Ready.wav

$TEMP/Sounds.wav