amigo_setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
amigo_setup.exe
Size 402KB
Sample260625-pg1hdabx2v
SHA256 a6e8593a6f6cf8b784bf560b071d258276b1a9314cda2076b5a2ea3fcdc7be44
MD5 1264c43dfcc13a17a360c4265b56ddf2
SHA1 86e9f4d92890b244d772104605683a31707b2f73
SHA512 0113f58dd547135bc25712e55fb9e03db06e5310cfd9b8a74d70d7b0b099d9e567229094c1114e0a75a0492790df4cf5c94c59cc7e5283adaffcc56dc7fa9766
SSDEEP 6144:3RLp3ES00VdQel2YQjXA3ILzLSto4Gx6dKAOLCma/d3QYw:3P0SvjQvjXA3GStc6dKFba/d5w
TLSH
T155947B11759DC03EC5621B320939E6A2957CBD704D30F61B63E87F2EBFB1191E628B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
amigo_setup.exe

File Explorer

amigo_setup.exe

.exe 402KB

amigo_setup.exe

IMPHASH 6d78ad438653ca646e019b1542388609
SHA256 a6e8593a6f6cf8b784bf560b071d258276b1a9314cda2076b5a2ea3fcdc7be44
MD5 1264c43dfcc13a17a360c4265b56ddf2
SHA1 86e9f4d92890b244d772104605683a31707b2f73
SHA512 0113f58dd547135bc25712e55fb9e03db06e5310cfd9b8a74d70d7b0b099d9e567229094c1114e0a75a0492790df4cf5c94c59cc7e5283adaffcc56dc7fa9766
SSDEEP 6144:3RLp3ES00VdQel2YQjXA3ILzLSto4Gx6dKAOLCma/d3QYw:3P0SvjQvjXA3GStc6dKFba/d5w
TLSH
T155947B11759DC03EC5621B320939E6A2957CBD704D30F61B63E87F2EBFB1191E628B62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70900

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\amigo_helpers\amigo_loader_lite\Release\AmigoLoaderLite.pdb

kernel32

UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery GetModuleFileNameW GetACP GetModuleHandleW GetProcAddress InterlockedCompareExchange CreateDirectoryW RemoveDirectoryW GetFileAttributesW DeleteFileW GetCurrentProcessId GlobalAlloc GlobalLock GlobalUnlock GetStartupInfoW CreateProcessW GetExitCodeProcess GetTempPathW SizeofResource FreeResource LockResource LoadLibraryW LoadResource FindResourceW FreeLibrary MultiByteToWideChar MoveFileExW WideCharToMultiByte MoveFileW GetCurrentProcess GetVersionExW GetNativeSystemInfo SetFileAttributesW lstrcmpiW CreateFileW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage EnterCriticalSection FindFirstFileExW FindClose WriteConsoleW GetFullPathNameW GetCurrentDirectoryW GetTimeZoneInformation SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle ExitProcess SetEndOfFile SetFilePointerEx GetConsoleCP WriteFile FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW ReadConsoleW GetConsoleMode ReadFile CopyFileW GetProcessHeap LocalFree HeapAlloc HeapReAlloc HeapSize GetCommandLineW HeapFree CloseHandle GetCurrentThreadId LeaveCriticalSection SetLastError DeleteCriticalSection DecodePointer RaiseException GetLastError SystemTimeToFileTime TzSpecificLocalTimeToSystemTime SetFileTime GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RtlUnwind FlushFileBuffers QueryPerformanceCounter TerminateProcess FindNextFileW InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent SetEvent LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead OutputDebugStringW IsDebuggerPresent GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW EncodePointer GetStringTypeW

user32

ReleaseCapture PtInRect DialogBoxParamW GetParent UpdateLayeredWindow GetDlgItem GetClientRect SetWindowLongW wsprintfW MoveWindow MapWindowPoints ClientToScreen CopyRect GetMonitorInfoW GetCapture IsWindow ShowWindow GetActiveWindow WindowFromPoint SetWindowTextW GetSystemMetrics EndDialog SendMessageW ScreenToClient FillRect MonitorFromWindow SetWindowPos IsWindowVisible GetWindowRect GetWindow CallWindowProcW DefWindowProcW UnregisterClassW EndPaint BeginPaint GetCursorPos InvalidateRect GetWindowLongW LoadImageW KillTimer SetTimer

gdi32

SetTextColor SetBkMode BitBlt CreateCompatibleBitmap SelectObject CreateDIBSection CreateCompatibleDC DeleteDC SetViewportOrgEx DeleteObject CreateSolidBrush GetStockObject

advapi32

RegCreateKeyExW RegSetValueExW RegQueryValueExW RegCloseKey

shell32

CommandLineToArgvW ShellExecuteW

ole32

CoTaskMemFree CreateStreamOnHGlobal CoCreateGuid StringFromCLSID

shlwapi

PathFileExistsW PathFindFileNameW

comctl32

_TrackMouseEvent

gdiplus

GdipCreateLineBrushFromRect GdipLoadImageFromStream GdipGetImageWidth GdipGetImageHeight GdipLoadImageFromFile GdiplusShutdown GdipSetStringFormatAlign GdipDrawImageI GdipDeleteFont GdipDeleteStringFormat GdipDeleteGraphics GdipStringFormatGetGenericDefault GdipMeasureString GdipSetTextRenderingHint GdipCreateFromHDC GdipDrawString GdipFree GdipGetGenericFontFamilySansSerif GdipCreateSolidFill GdipCreateFont GdipCreatePath GdipSetSmoothingMode GdipDisposeImage GdipDeletePath GdipCreateBitmapFromHBITMAP GdipDrawImageRectI GdipAlloc GdipDeleteBrush GdipCloneImage GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateStringFormat GdipFillRectangle GdiplusStartup

Name

.text

Size

188KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

492B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

117KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

amigo_setup.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

comctl32

gdiplus

generic