AMPER[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AMPER.dll
Size 2.8MB
Sample260916-r9ywcssakh
SHA256 7514344506c9e1c7831ab34a9d6df214626ef767c102a9ac575e50088b58fce9
MD5 2841d7c826d6479c7f9159ce56b73fd6
SHA1 c94a6303475ebb70db34fc7f7e5bfefd4b71dc0b
SHA512 0977bcd6de0fd7eddde6e9d737800173947fd9cb72fbb662d9759f1d042c4cccd04bb660848cacfb91f1a6497697900d91e4375852f4bf2f3ad86aa5cf30f123
SSDEEP 49152:BT/5oAo1uTpnqo8AVBUxXNkyq9uGX7wT1v9AMan70ce65f71mx/thH:BTRDoUh8ALUxXNkNuuEbAzn70cFG/t1
TLSH
T1AFD52346F6D408B9D6B78138C5739906F771788907608BDF23984A292F73FE16A3B712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AMPER.dll

File Explorer

AMPER.dll

.dll 2.8MB

AMPER.dll

IMPHASH 1e35398d64a17b0cb444249f68313d4b
SHA256 7514344506c9e1c7831ab34a9d6df214626ef767c102a9ac575e50088b58fce9
MD5 2841d7c826d6479c7f9159ce56b73fd6
SHA1 c94a6303475ebb70db34fc7f7e5bfefd4b71dc0b
SHA512 0977bcd6de0fd7eddde6e9d737800173947fd9cb72fbb662d9759f1d042c4cccd04bb660848cacfb91f1a6497697900d91e4375852f4bf2f3ad86aa5cf30f123
SSDEEP 49152:BT/5oAo1uTpnqo8AVBUxXNkyq9uGX7wT1v9AMan70ce65f71mx/thH:BTRDoUh8ALUxXNkNuuEbAzn70cFG/t1
TLSH
T1AFD52346F6D408B9D6B78138C5739906F771788907608BDF23984A292F73FE16A3B712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

159864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Tunca\Desktop\wdl-ol-Anob\IPlugExamples\AMPER\build-win\vst2\x64\bin\AMPER.pdb

comctl32

InitCommonControlsEx

wininet

InternetGetConnectedState

kernel32

SetStdHandle GetStringTypeW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation LCMapStringW CreateFileW GetTimeFormatW GetDateFormatW GetConsoleCP WriteFile ReadConsoleW GetConsoleMode SetFilePointerEx GetFileType GetStdHandle HeapAlloc HeapFree HeapReAlloc GetModuleFileNameW GetModuleHandleExW QueryPerformanceFrequency ReadFile LoadLibraryExW FreeLibrary TlsFree TlsSetValue FlushFileBuffers HeapSize SetEndOfFile WriteConsoleW ExitProcess LoadResource LockResource FindResourceA SizeofResource MultiByteToWideChar GlobalUnlock WideCharToMultiByte GetCurrentProcessId GlobalLock CompareStringW GetModuleFileNameA DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection TlsGetValue TlsAlloc EncodePointer SetLastError GetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent CloseHandle InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList

user32

DefWindowProcA DrawTextA DrawTextW GetWindowThreadProcessId GetKeyState GetWindowRect LoadCursorA DestroyWindow SetWindowPos ScreenToClient CreatePopupMenu GetClassNameA TrackPopupMenu OpenClipboard GetCapture SetTimer ClientToScreen CloseClipboard CallWindowProcA GetWindowLongA ValidateRect TrackMouseEvent SetWindowTextA EndPaint RegisterClassA EnumWindows MessageBoxA DestroyMenu CreateWindowExA SetFocus GetUpdateRect GetClipboardData SendMessageA SetCapture AppendMenuA PeekMessageA IsClipboardFormatAvailable GetWindowLongPtrA UnregisterClassA GetParent SetWindowLongPtrA UpdateWindow ReleaseCapture ShowCursor InvalidateRect GetAncestor SetCursorPos GetCursorPos BeginPaint

gdi32

GetClipRgn CreateRectRgn SelectClipRgn GetTextMetricsA IntersectClipRect SelectObject CreateDIBSection CreateCompatibleDC DeleteDC DeleteObject BitBlt GetStockObject SetTextColor SetBkMode SetBkColor CreateFontA

comdlg32

ChooseColorA GetSaveFileNameA GetOpenFileNameA

advapi32

RegCloseKey RegOpenKeyA

shell32

SHGetSpecialFolderPathA SHGetFolderPathA ShellExecuteA

Name

.text

Size

288KB

Virtual Size

287KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AMPER.dll

comctl32

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

generic