amsrani.zip
- SHA256 a9e96b07d1b9e28a91938ad11f41309b5a7428debbd92689043430d24867bdd9
Password
as
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
amsrani.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
300 seconds
Behavioral task
behavioral2
Sample
amsrani.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
General
- Target amsrani.zip
- Size 659KB
- Sample260804-la4dxastat
- SHA256 a9e96b07d1b9e28a91938ad11f41309b5a7428debbd92689043430d24867bdd9
- MD5 b7dab51506e1e7742fa38164030a6722
- SHA1 4272d77fdfb48adfdf37cab1b048574c5a8136d8
- SHA512 7ce2d9e4ad26f7bab1dbea2b21149429bbdf52036884686d331e577c26c0c6165e9ca4ee4886872d74970129f90960d65eda389c60f0564cb377db36645ba661
- SSDEEP 12288:zyDLlAG74tD5c7yNLw2vvWnjQbmVm9G5lIhBXpyBwhdcL:zsGztDLjUhVm9pFYi7u
- TLSH T149E4233355B8E40FDB2E11BA751B0D6858D28BA931B39B3C5C69D20F79CF2225DD8C62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/amsrani.exe
File Explorer
-
amsrani.zip.zip 659KB
-
amsrani.exe.exe 2.3MB
amsrani.exe
- IMPHASH 5c586b3409700c044b79f45b5e9e20e1
- SHA256 93412f3ad1cad6678d76ff62e276bf5fba5058d3d0db8756042fef4026e1cf5d
- MD5 a52c2abccea02a609a8a0370f3988f67
- SHA1 ae4272b309d59747ac660364c80c0d46d9edbadd
- SHA512 a515532fc1e2c422d227c2584b450abbc15fb28269a1f4f631e08b1135a31159a90c89c3d8a0c17da7f58edc672732cf239ce0b3650504affd3b809f0583fbcf
- SSDEEP 24576:DvdhlGFD48ET/0k7NmhC3Gn2DLY0RaSdEVLtifnv6F6H:Dvdhm/ET/3NmY3Gn2NRaSdEVL8fniF
- TLSH T180B5F82572FA14A5D1AAC035A9079767CD30704E133D52FB539889C52FB03E8AAFDB63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
as
Minor OS version
0
Major OS version
6
Entry point
901357
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\richu\Desktop\fuckambani\bin\Debug-x64\AmbaniLoader.pdb
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
DwmSetWindowAttribute
DwmIsCompositionEnabled
DwmGetColorizationColor
DwmEnableBlurBehindWindow
kernel32
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
HeapFree
GetCurrentProcessId
LoadLibraryA
GetLocaleInfoA
IsDBCSLeadByte
GetModuleHandleW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
RaiseException
SetUnhandledExceptionFilter
GetStartupInfoW
OutputDebugStringA
GetSystemTimeAsFileTime
InitializeSListHead
GetLastError
GetProcAddress
HeapAlloc
GetProcessHeap
GetModuleHandleA
VirtualQuery
GetCurrentThreadId
user32
ClientToScreen
ScreenToClient
LoadCursorW
MonitorFromWindow
SetProcessDPIAware
ReleaseDC
DispatchMessageW
PeekMessageW
PostQuitMessage
UnregisterClassW
RegisterClassExW
GetCursorPos
DestroyWindow
ShowWindow
SetLayeredWindowAttributes
SetWindowPos
GetSystemMetrics
UpdateWindow
GetWindowRect
SetCursor
GetDC
GetForegroundWindow
IsWindowUnicode
ReleaseCapture
SetCursorPos
CreateWindowExW
GetClientRect
SetCapture
GetCapture
GetKeyState
DefWindowProcW
GetMessageExtraInfo
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
GetKeyboardLayout
TrackMouseEvent
TranslateMessage
gdi32
GetDeviceCaps
CreateRectRgn
DeleteObject
shell32
ShellExecuteW
ShellExecuteA
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
vcruntime140d
__current_exception_context
__C_specific_handler_noexcept
__C_specific_handler
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_LoadLibraryExW
__std_type_info_destroy_list
__current_exception
strstr
strchr
memchr
memset
memmove
memcpy
memcmp
vcruntime140_1d
__CxxFrameHandler4
ucrtbased
qsort
fabs
ceilf
cosf
fmodf
sqrtf
_localtime64_s
_time64
strcpy
strncmp
toupper
floorf
powf
sinf
acosf
atof
log
pow
atan2f
logf
realloc
abs
_lrotl
strtol
fopen_s
feof
ferror
fgetc
ungetc
ldexp
_CrtDbgReport
_CrtDbgReportW
terminate
_seh_filter_dll
_configure_narrow_argv
free
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_seh_filter_exe
_set_app_type
__setusermatherr
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_set_fmode
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
_free_dbg
strcpy_s
strcat_s
__stdio_common_vsprintf_s
_wmakepath_s
_wsplitpath_s
wcscpy_s
__stdio_common_vsscanf
fread
fflush
fclose
_wfopen
__acrt_iob_func
_wassert
strncpy
strlen
strcmp
malloc
__stdio_common_vsprintf
__stdio_common_vfprintf
fwrite
ftell
_initialize_narrow_environment
fseek
Name
.textbss
Size
Virtual Size
862KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
502KB
Virtual Size
502KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
25KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
52KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.msvcjmc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
1024B
Virtual Size
822B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=35721,
count=4, id=259, version=35721,
count=11, id=260, version=35721,
count=32, id=261, version=35721,
count=19, id=257, version=33145,
count=186, id=1, productName=Unmarked objects,
count=8, id=261, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,