AMIDEWINx64[.]EXE | Triage™

General

Target
AMIDEWINx64.EXE
Size 377KB
Sample260803-c77cdsbb84
SHA256 18969e7f7f75cddaad96d5ca2cc45110afc42ad2ad8e0e17a2e3e4afca312f06
MD5 97bea101348479d29c609ddd82ca8926
SHA1 d814c5dc3e1b58e75d1ae25dcaa77dd1db14c7a1
SHA512 d1e4f95093f5afd1beb4ee2e4279fdb5929de928443e4888c0680b7d7eb74d4c3beaef9356859733790d9ce64647db9466535617dd9da8186d96b05472a6df94
SSDEEP 6144:8YF3mEzg2Dm/BPZw5/C3PCrhbb2kfsGPJ0NAOOAsVLBfnsWr9/ZRIcY:P1gom/Bxw5/C3PCrhbb2kfsGPJ0y5BfX
TLSH
T13F84F52AEB9620F4EC7791BC84922306FBE075684731D7D777AD460A1F33AE4A939710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AMIDEWINx64.EXE

File Explorer

AMIDEWINx64.EXE

.exe 377KB

AMIDEWINx64.EXE

IMPHASH e3d5de629e09ae6898196a1418661d7f
SHA256 18969e7f7f75cddaad96d5ca2cc45110afc42ad2ad8e0e17a2e3e4afca312f06
MD5 97bea101348479d29c609ddd82ca8926
SHA1 d814c5dc3e1b58e75d1ae25dcaa77dd1db14c7a1
SHA512 d1e4f95093f5afd1beb4ee2e4279fdb5929de928443e4888c0680b7d7eb74d4c3beaef9356859733790d9ce64647db9466535617dd9da8186d96b05472a6df94
SSDEEP 6144:8YF3mEzg2Dm/BPZw5/C3PCrhbb2kfsGPJ0NAOOAsVLBfnsWr9/ZRIcY:P1gom/Bxw5/C3PCrhbb2kfsGPJ0y5BfX
TLSH
T13F84F52AEB9620F4EC7791BC84922306FBE075684731D7D777AD460A1F33AE4A939710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

4652

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetFileType GetStartupInfoW DeleteCriticalSection EncodePointer DecodePointer FlsFree SetLastError FlsSetValue FlsGetValue GetLastError GetCurrentThreadId FlsAlloc HeapSetInformation HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection OutputDebugStringA RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx SetConsoleCtrlHandler FreeLibrary SetHandleCount LoadLibraryExW HeapFree HeapAlloc GetCPInfo GetACP GetOEMCP Sleep TerminateProcess GetCurrentProcess UnhandledExceptionFilter LCMapStringW MultiByteToWideChar GetStringTypeW HeapReAlloc VirtualProtect VirtualAlloc SetThreadStackGuarantee GetSystemInfo VirtualQuery GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle WriteFile ExitProcess GetModuleHandleW GetProcAddress SetUnhandledExceptionFilter GetVersionExW InitializeCriticalSectionAndSpinCount GetCommandLineA SetEndOfFile SetStdHandle GetSystemFirmwareTable GetVersionExA SetThreadExecutionState CreateMutexA SetProcessAffinityMask GetCurrentDirectoryA GetModuleHandleA DeleteFileA GetWindowsDirectoryA LoadLibraryA GetSystemDirectoryA CloseHandle GetFullPathNameA CreateNamedPipeA CreateFileA ReadFile CreateThread LocalFree DeviceIoControl LocalSize LocalAlloc lstrlenA FormatMessageA ReadConsoleInputA SetConsoleMode GetConsoleMode HeapSize GetConsoleCP FlushFileBuffers CreateFileW WriteConsoleW SetFilePointer GetProcessHeap

advapi32

StartServiceA OpenSCManagerA OpenServiceA CloseServiceHandle QueryServiceStatusEx ControlService DeleteService OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA CreateServiceA

shell32

ShellExecuteA

user32

ExitWindowsEx RegisterClassExA DefWindowProcA DispatchMessageA BlockInput GetMessageA MessageBoxA CreateWindowExA SystemParametersInfoA TranslateMessage

Sharing