amtlib[.]dll[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
amtlib.dll.exe
Size 2.3MB
Sample260930-bf7cmsvhjg
SHA256 9b510f38acb2a70c840b17a9fed2584f08bf38395f087212dd41b059f791126f
MD5 62027922186afa99fdd51be581a22b32
SHA1 2eb23d99f4cb1a449356d21e72326fa8bfc1cdc3
SHA512 72078988fe0bfb2bc846dc959c57d25b48871a8b96e4312c9ef6a9601448f57f51a633ee56863c87eef1d53dc279fde01d3886b39493f411e794de16038c9030
SSDEEP 49152:5v7B1M4fRyjMrNSVpgxbwYE+sHVovr/nd9txZXDDXmrIgJETyREmuzu99r0:5JjZ8ET29A
TLSH
T12BB56C1A726841A4D177C2BDCA979747F2B274054B31AFCB42A4826E1F37FE9063E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
amtlib.dll.exe

File Explorer

amtlib.dll.exe

.dll 2.3MB

amtlib.dll.exe

IMPHASH ddd25311119645ff2bd778c7d7f1f05d
SHA256 9b510f38acb2a70c840b17a9fed2584f08bf38395f087212dd41b059f791126f
MD5 62027922186afa99fdd51be581a22b32
SHA1 2eb23d99f4cb1a449356d21e72326fa8bfc1cdc3
SHA512 72078988fe0bfb2bc846dc959c57d25b48871a8b96e4312c9ef6a9601448f57f51a633ee56863c87eef1d53dc279fde01d3886b39493f411e794de16038c9030
SSDEEP 49152:5v7B1M4fRyjMrNSVpgxbwYE+sHVovr/nd9txZXDDXmrIgJETyREmuzu99r0:5JjZ8ET29A
TLSH
T12BB56C1A726841A4D177C2BDCA979747F2B274054B31AFCB42A4826E1F37FE9063E721
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

2d:d9:77:ef:c9:80:f3:b7:98:42:51:3b:2c:3a:5a:3a:4e:3a:1e:7e

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Adobe Systems Incorporated,OU=Photoshop\, Bridge - SHA256+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Chains

Apr 23, 2013

CN=Adobe Systems Incorporated,OU=Photoshop\, Bridge - SHA256+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Adobe Systems Incorporated,OU=Photoshop\, Bridge - SHA256+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Serial Number

2e:4f:ac:6f:27:5c:b1:bf:c6:fb:0b:b9:d4:8b:c5:1e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 28, 2013 - Mar 1, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

1492400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

none

winhttp

WinHttpGetProxyForUrl WinHttpOpen WinHttpGetIEProxyConfigForCurrentUser WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpSetStatusCallback WinHttpCrackUrl WinHttpConnect WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSetCredentials WinHttpSendRequest WinHttpReadData WinHttpQueryHeaders WinHttpCloseHandle

setupapi

CM_Get_DevNode_Status SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW

iphlpapi

GetIfTable

shlwapi

PathFileExistsW PathRemoveExtensionW PathRenameExtensionW PathAppendW PathAddExtensionW PathRemoveFileSpecW PathIsFileSpecW PathIsDirectoryW

kernel32

GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetLocaleInfoW HeapSize GetStdHandle ExitProcess CloseHandle GetCurrentProcess GetLastError GetCurrentThread SetLastError FormatMessageW FreeLibrary LoadLibraryW LocalFree GetProcAddress QueryPerformanceCounter GetStartupInfoW GetEnvironmentVariableA GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetTempPathW GetDateFormatW GetTimeFormatW GetLocalTime CreateSemaphoreW ReleaseSemaphore WaitForSingleObject InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EnterCriticalSection CreateThread SetEvent OpenEventW QueryPerformanceFrequency GetTimeZoneInformation GetVersionExW GetComputerNameExW OutputDebugStringA TryEnterCriticalSection SetFilePointer WriteFile CreateFileW GetFileSizeEx GetCurrentThreadId SwitchToThread ResumeThread CreateMutexW OpenMutexW ReleaseMutex FindClose FindNextFileW FindFirstFileW GlobalFree WaitForMultipleObjects CreateEventW CreateProcessW CreateDirectoryW GetFileAttributesW LocalAlloc SetFileAttributesW IsDBCSLeadByteEx GetFileSize SetEndOfFile UnlockFileEx ReadFile FlushFileBuffers LockFileEx lstrlenA lstrlenW GetModuleHandleW IsValidCodePage GetOEMCP FreeEnvironmentStringsW GetEnvironmentStringsW GetFileInformationByHandle PeekNamedPipe GetCurrentDirectoryW SetCurrentDirectoryW GetModuleFileNameA SetStdHandle CreateFileA GetFileAttributesA GetConsoleCP DeleteFileA GetConsoleMode FatalAppExitA GetFullPathNameA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetConsoleCtrlHandler GetProcessHeap WriteConsoleW CompareStringW SetEnvironmentVariableA GetTickCount GetACP HeapDestroy HeapCreate GetVersion HeapSetInformation RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess FlsAlloc FlsFree FlsGetValue GetCPInfo LCMapStringW MoveFileA FindFirstFileExA GetDriveTypeA MoveFileW GetTimeFormatA GetStringTypeW Sleep EncodePointer DecodePointer RaiseException RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx GetSystemTimeAsFileTime HeapFree HeapReAlloc HeapAlloc GetFullPathNameW FlsSetValue GetCommandLineA FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileExW SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime DeleteFileW GetCurrentProcessId GetDateFormatA

user32

wsprintfW MessageBoxW

advapi32

RegQueryValueExW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegDeleteKeyA RegOpenKeyA RegCreateKeyA SetSecurityInfo CreateWellKnownSid GetNamedSecurityInfoW SetEntriesInAclW SetNamedSecurityInfoW RegOpenKeyExW RegCreateKeyExW RegSetValueExW RegCloseKey RegDeleteKeyW SetTokenInformation OpenThreadToken OpenProcessToken GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid

shell32

SHGetFolderPathW ShellExecuteA SHCreateDirectoryExW

ole32

CoInitializeSecurity CoCreateInstance CoSetProxyBlanket CoUninitialize CoInitializeEx

oleaut32

CreateErrorInfo SetErrorInfo VariantInit VariantChangeType GetErrorInfo SysAllocStringByteLen VariantClear SysStringLen SysAllocString SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

amtlib.dll.exe

PE Signature issue

winhttp

setupapi

iphlpapi

shlwapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic