Amcap[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Amcap.zip
Size 295KB
Sample260910-prf7gstbmc
SHA256 49655a1fbbee74c8e87ebad876fbc8775c45228e21eb6024d24405589813d05b
MD5 f2397a7c2237b148c61e1048cc3bc932
SHA1 3c0f93fdf9caa7507656ece5ad8fe242a0cda068
SHA512 5b1522d0fc7073d33e28f709c1062d25c5423e3005aea862feb13af591f5b4c39445b2afd7ad90676bf5c983b0b05d52af58f1f9e73ff650c97fdd60b7410b27
SSDEEP 6144:rnuu1KvY4R0yMzf1e2ySrH3DKOa8l9ihYVK8g0cvz7lw0:rlqY4RN4fA2yGH3en8YF8g0cv/lw0
TLSH
T19E5423A9CC3E849FC0C44BF02795AE0ADB87D8CD76512064B484DBBD5B4243CF9B662B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Amcap.exe

File Explorer

Amcap.zip

.zip 295KB
Amcap.exe

.exe 619KB
__MACOSX/._Amcap.exe

176B

Amcap.zip

SHA256 49655a1fbbee74c8e87ebad876fbc8775c45228e21eb6024d24405589813d05b
MD5 f2397a7c2237b148c61e1048cc3bc932
SHA1 3c0f93fdf9caa7507656ece5ad8fe242a0cda068
SHA512 5b1522d0fc7073d33e28f709c1062d25c5423e3005aea862feb13af591f5b4c39445b2afd7ad90676bf5c983b0b05d52af58f1f9e73ff650c97fdd60b7410b27
SSDEEP 6144:rnuu1KvY4R0yMzf1e2ySrH3DKOa8l9ihYVK8g0cvz7lw0:rlqY4RN4fA2yGH3en8YF8g0cv/lw0
TLSH
T19E5423A9CC3E849FC0C44BF02795AE0ADB87D8CD76512064B484DBBD5B4243CF9B662B
MD5 SHA1 SHA512 SSDEEP TLSH

Amcap.exe

IMPHASH 5d4b8f8ed2816fdabae68fc26095ed5c
SHA256 894f5b51b0b3563ef62d8d5a8dad1fbe580c8f35c5b72eccb90a8c00103e7ce7
MD5 31930d3b4a619b12323aa62f438eb605
SHA1 1bff20b46fe3d083dfb01613211f957e76061fd5
SHA512 ea736b10c47723978dfdbd21fe2f188949e586a1edc5f4e2a21c8029112fe17d01bcad2de39fa757026bff2e23df54023f150fdf1075f7e9ee32d3f6110b10ac
SSDEEP 12288:+rX7x+Ibz29ZoKMzjGFE2NQHrNtBFvTaB58nfd1SsW:y4I2nE22j85efd1p
TLSH
T1C4D45B2237D1C076C17234724B5AA3B536AFB87149765A0B7BD40B3C2F746B29E2835E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

326352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Cap软件\Amcap\内部测试用\修改版\2010.07.07-AMCap v3.0.9 source code\Release_Unicode\amcap(3.0.9).pdb

winmm

timeGetTime

olepro32

ord250

kernel32

GetFileSizeEx GetFileTime GetPrivateProfileIntW WritePrivateProfileStringW GetPrivateProfileStringW GetCurrentDirectoryW HeapFree HeapAlloc GetCommandLineA GetStartupInfoA HeapReAlloc HeapSize ExitThread CreateThread TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStdHandle GetModuleFileNameA FatalAppExitA SetConsoleCtrlHandler InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP SetFileTime LocalFileTimeToFileTime IsValidCodePage GetTimeZoneInformation HeapCreate HeapDestroy VirtualFree VirtualAlloc FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetLocaleInfoA GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale FileTimeToLocalFileTime SetErrorMode GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW CompareStringA InterlockedExchange GetModuleHandleA CreateEventW SuspendThread SetEvent WaitForSingleObject ResumeThread SetThreadPriority GlobalFlags SystemTimeToFileTime FileTimeToSystemTime SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW lstrlenA lstrcmpA GetAtomNameW GlobalGetAtomNameW TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GetShortPathNameW GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose GetCurrentProcess DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer ReadFile GetThreadLocale GetStringTypeExW DeleteFileW MoveFileW FreeResource GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW LoadLibraryA lstrcmpW GetVersionExA SetLastError CopyFileW FormatMessageW LocalFree MulDiv GlobalAlloc GlobalFree GlobalLock GlobalUnlock GlobalSize GetFileAttributesW CreateDirectoryW WriteFile lstrcmpiW LoadLibraryExW MultiByteToWideChar FreeLibrary RaiseException GetLastError GetModuleFileNameW DeleteCriticalSection InterlockedDecrement InterlockedIncrement InitializeCriticalSection LoadResource LockResource SizeofResource FindResourceW Sleep GetCurrentProcessId WriteProfileStringW CreateFileW GetSystemTimeAsFileTime GetFileSize CloseHandle WideCharToMultiByte GetSystemDirectoryW LoadLibraryW lstrlenW GetVersionExW lstrcpyW GetProfileStringW GetProfileIntW GetModuleHandleW GetProcAddress lstrcpynW lstrcatW RtlUnwind ExitProcess CreateFileA SetFileAttributesW SetEnvironmentVariableA

user32

SetPropW GetPropW RemovePropW GetWindowTextLengthW GetForegroundWindow GetLastActivePopup SetActiveWindow BeginDeferWindowPos EndDeferWindowPos GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints TrackPopupMenuEx TrackPopupMenu GetKeyState SetScrollRange GetScrollRange SetForegroundWindow ShowScrollBar IsWindowVisible GetClassInfoExW GetClassInfoW AdjustWindowRectEx ScreenToClient EqualRect DeferWindowPos CopyRect PtInRect SetWindowPlacement GetDlgCtrlID CallWindowProcW OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetWindow GetFocus IsWindowEnabled GetParent GetMenuState GetMenuStringW GetMenuItemID InsertMenuW GetWindowTextW GetSysColor CharNextW SendDlgItemMessageW EnableWindow GetDlgItem SetScrollInfo RegisterHotKey SetMenu UnregisterHotKey LoadMenuW GetSysColorBrush GetScrollInfo SetScrollPos ScrollWindow GetDlgItemInt CheckDlgButton GetDlgItemTextW IsDlgButtonChecked EndDialog DialogBoxParamW SetClassLongW GetClassNameW GetClassLongW CallNextHookEx SetWindowsHookExW GetCapture IsChild WinHelpW GetMenuItemCount wsprintfW RemoveMenu AppendMenuW InvalidateRect SetTimer UpdateWindow MessageBoxW IsWindow KillTimer DestroyWindow CreateDialogParamW SendMessageW SetFocus GetWindowRect GetClientRect ClientToScreen SetWindowPos EnableMenuItem CheckMenuItem GetMenu GetSubMenu PostQuitMessage GetAsyncKeyState PostMessageW BeginPaint GetWindowThreadProcessId ModifyMenuW LoadBitmapW GetMenuCheckMarkDimensions SetMenuItemBitmaps GetNextDlgTabItem CreateDialogIndirectParamW GetActiveWindow GetDesktopWindow InflateRect GetMenuItemInfoW SystemParametersInfoW ValidateRect GetCursorPos GetMessageW FillRect TabbedTextOutW DrawTextW DrawTextExW GrayStringW GetWindowDC UnregisterClassW DestroyIcon GetDialogBaseUnits SetRectEmpty SetCursor ShowOwnedPopups DeleteMenu BringWindowToTop CreatePopupMenu SetCapture LockWindowUpdate GetDCEx UnionRect SetParent GetSystemMenu IsRectEmpty MapVirtualKeyW GetKeyNameTextW WindowFromPoint SetRect EndPaint SetDlgItemTextW SendDlgItemMessageA RegisterWindowMessageW CharUpperW CheckRadioButton SetDlgItemInt IsDialogMessageW ScrollWindowEx GetSystemMetrics MoveWindow DefWindowProcW PeekMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW WaitMessage LoadAcceleratorsW LoadStringW LoadCursorW LoadIconW RegisterClassW GetDC ReleaseDC CreateWindowExW GetWindowLongW SetWindowLongW ShowWindow SetWindowTextW UnpackDDElParam ReuseDDElParam GetMenuBarInfo ReleaseCapture GetScrollPos InsertMenuItemW DestroyMenu

gdi32

CreateBitmap CreateFontIndirectW GetTextExtentPoint32W SaveDC RestoreDC SetBkMode SetPolyFillMode SetROP2 SetStretchBltMode SetGraphicsMode SetWorldTransform ModifyWorldTransform SetMapMode ExcludeClipRect IntersectClipRect OffsetClipRgn LineTo MoveToEx SetTextAlign SetTextJustification SetTextCharacterExtra SetMapperFlags SetArcDirection SetColorAdjustment SelectClipRgn GetClipRgn CreateRectRgn SelectClipPath GetViewportExtEx GetWindowExtEx GetPixel StartDocW PtVisible RectVisible GetObjectW CreateDCW SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetCurrentPositionEx ArcTo PolyDraw PolylineTo PolyBezierTo ExtSelectClipRgn CreateDIBPatternBrushPt CreatePatternBrush SelectPalette PlayMetaFileRecord GetObjectType EnumMetaFile PlayMetaFile CreatePen ExtCreatePen CreateHatchBrush GetCharWidthW StretchDIBits CreateCompatibleBitmap CreateRectRgnIndirect SetRectRgn CombineRgn GetMapMode DPtoLP GetBkColor GetClipBox TextOutW GetDCOrgEx CopyMetaFileW GetDeviceCaps SetBkColor SetTextColor ExtTextOutW PatBlt CreateSolidBrush CreateFontW StretchBlt CreateCompatibleDC CreateDIBitmap BitBlt DeleteObject DeleteDC GetStockObject GetTextMetricsW Escape SelectObject

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

comdlg32

GetOpenFileNameW GetFileTitleW

advapi32

RegSetValueExW RegEnumKeyW RegQueryValueW RegCreateKeyW RegOpenKeyW RegSetValueW RegQueryInfoKeyW RegCloseKey RegEnumKeyExW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegQueryValueExW

shell32

SHBrowseForFolderW SHGetFileInfoW ExtractIconW DragFinish DragQueryFileW SHGetPathFromIDListW

ole32

CoTreatAsClass ReleaseStgMedium ReadClassStg ReadFmtUserTypeStg OleRegGetUserType WriteClassStg WriteFmtUserTypeStg SetConvertStg CreateStreamOnHGlobal CoTaskMemRealloc CoTaskMemAlloc CoGetMalloc GetRunningObjectTable CreateItemMoniker CreateBindCtx MkParseDisplayName CoTaskMemFree CoCreateInstance CoUninitialize CoInitializeEx OleDuplicateData CoDisconnectObject StringFromGUID2 CLSIDFromString StringFromCLSID

oleaut32

SafeArrayCopy VarBstrFromDate VarDecFromStr VarBstrFromDec VarBstrFromCy VarCyFromStr SysReAllocStringLen VarDateFromStr SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayDestroy SafeArrayUnlock SafeArrayLock SafeArrayPutElement SafeArrayPtrOfIndex SafeArrayGetElement SysFreeString SafeArrayAllocDescriptor SafeArrayAllocData VariantCopy SafeArrayRedim SafeArrayCreate SafeArrayGetDim SafeArrayGetElemsize SafeArrayGetLBound SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData LoadRegTypeLi LoadTypeLi RegisterTypeLi VariantInit VariantChangeType VariantClear SysAllocStringLen SysStringByteLen SysAllocStringByteLen SysStringLen VarUI4FromStr

comctl32

CreateStatusWindowW

shlwapi

PathRemoveExtensionW PathStripToRootW PathIsUNCW PathFindFileNameW PathFindExtensionW PathRemoveFileSpecW

gdiplus

GdipCreateFromHWNDICM GdipCreateFromHWND GdipCreateBitmapFromGdiDib GdipDrawImageRectI GdipCloneImage GdipDisposeImage GdipSaveImageToStream GdipAlloc GdipCreateBitmapFromHBITMAP GdipCreateFromHDC GdipDrawImageRect GdipDeleteGraphics GdiplusShutdown GdiplusStartup GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipGetImageEncoders GdipGetImageEncodersSize GdipFree

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject