amtlib[.]dll[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
amtlib.dll.exe
Size 2.6MB
Sample260930-djkn6axwcs
SHA256 fa10747c83596b444b553166f6d9752e235dc043c8d276d5eb56e47c49a49412
MD5 1bcd7ff858c219c0e10f80944b982dc4
SHA1 b6087da32950c3bbb3529d45b86019e2695e726f
SHA512 cbd8c1266ba90ce850cefb6246d10eb981aaf8fcc2187d2ae85a3861cd4f81784d0f4e8f383f343bc79e2dbc23917258f76ce216ae63cb5bab7627a7053c5997
SSDEEP 49152:9r8DM50KiRb9a3K4Au+WlSOor+B0De35/2TUKzm4imV3Bjne/5yyGAu6MmXYN+6:9rQIB6m4hopr6
TLSH
T1C4C56B0A3AA84165C0B7C1BDCA878787F2B2B4050B35ABCF46A4435E1F73BE5467E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
amtlib.dll.exe

File Explorer

amtlib.dll.exe

.dll 2.6MB

amtlib.dll.exe

IMPHASH 654d46ac2ef87ad2261d7b2a3f91c4ac
SHA256 fa10747c83596b444b553166f6d9752e235dc043c8d276d5eb56e47c49a49412
MD5 1bcd7ff858c219c0e10f80944b982dc4
SHA1 b6087da32950c3bbb3529d45b86019e2695e726f
SHA512 cbd8c1266ba90ce850cefb6246d10eb981aaf8fcc2187d2ae85a3861cd4f81784d0f4e8f383f343bc79e2dbc23917258f76ce216ae63cb5bab7627a7053c5997
SSDEEP 49152:9r8DM50KiRb9a3K4Au+WlSOor+B0De35/2TUKzm4imV3Bjne/5yyGAu6MmXYN+6:9rQIB6m4hopr6
TLSH
T1C4C56B0A3AA84165C0B7C1BDCA878787F2B2B4050B35ABCF46A4435E1F73BE5467E761
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ed:e6:e0:e0:d5:cb:08:e6:32:de:67:71:f2:b3:aa:f0:ad:5c:38:4c

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Flash Pro\, Flash Builder\, Flash Access\, Flash Gaming\, Flash Med,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 27, 2016

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

Serial Number

79:6b:80:82:54:c6:eb:0c:37:be:0a:2a:de:81:dc:5a

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2015 - Oct 28, 2017

Minor OS version

Major OS version

Entry point

1718244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

amtlib.pdb

iphlpapi

GetIfTable

winhttp

WinHttpSendRequest WinHttpSetStatusCallback WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpQueryHeaders WinHttpSetCredentials WinHttpReceiveResponse WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData

setupapi

SetupDiGetDeviceInstanceIdW CM_Get_DevNode_Status SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW

shlwapi

PathFileExistsW PathRemoveExtensionW PathRenameExtensionW PathAppendW PathAddExtensionW PathRemoveFileSpecW PathFindFileNameW PathIsFileSpecW PathIsDirectoryW

kernel32

IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetModuleHandleW GetStartupInfoW TlsFree CloseHandle GetLastError GetCurrentProcess GetCurrentThread SetLastError FreeLibrary GetProcAddress LocalFree FormatMessageW LoadLibraryW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableA GetModuleFileNameW WideCharToMultiByte CreateFileW DeleteFileW GetFileAttributesW GetFileSize LockFileEx ReadFile SetEndOfFile SetFileAttributesW SetFilePointer UnlockFileEx WriteFile GetSystemTime SystemTimeToFileTime DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount GetUserDefaultLCID GetComputerNameExW MultiByteToWideChar GetTempPathW GetLocalTime GetDateFormatW GetTimeFormatW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent ReleaseSemaphore WaitForSingleObject OpenEventW CreateThread GetTickCount CreateSemaphoreW GetTimeZoneInformation GetVersionExW OutputDebugStringA TryEnterCriticalSection GetCurrentThreadId SwitchToThread ResumeThread lstrlenA GetFileSizeEx CreateMutexW OpenMutexW ReleaseMutex CreateProcessW FindClose FindFirstFileW FindNextFileW CreateEventW GlobalFree WaitForMultipleObjects lstrlenW CreateDirectoryW LocalAlloc IsDBCSLeadByteEx FlushFileBuffers TlsSetValue WriteConsoleW TlsGetValue TlsAlloc EnumSystemLocalesW ExitProcess GetModuleHandleExW IsValidCodePage GetACP GetOEMCP GetStdHandle GetConsoleMode ReadConsoleW GetFileType GetModuleFileNameA GetEnvironmentStringsW FreeEnvironmentStringsW SetFilePointerEx FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe SetCurrentDirectoryW GetCurrentDirectoryW SetStdHandle GetConsoleCP GetFullPathNameA SetConsoleCtrlHandler OutputDebugStringW SetEnvironmentVariableA DeleteCriticalSection TerminateProcess Sleep SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCPInfo FatalAppExitA AreFileApisANSI LoadLibraryExW MoveFileExW GetCurrentProcessId GetFileAttributesExW SetFileTime LocalFileTimeToFileTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW FindFirstFileExW GetCommandLineA GetFullPathNameW GetStringTypeW EncodePointer RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent

user32

MessageBoxW wsprintfW UnregisterClassW

advapi32

RegQueryValueExA RegOpenKeyA RegDeleteKeyA RegCreateKeyA RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteKeyW RegCreateKeyExW RegCloseKey SetSecurityInfo SetNamedSecurityInfoW GetNamedSecurityInfoW CreateWellKnownSid SetTokenInformation OpenThreadToken SetEntriesInAclW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetUserNameW GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid OpenProcessToken

shell32

SHGetFolderPathW ShellExecuteA SHCreateDirectoryExW

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

CreateErrorInfo SetErrorInfo VariantChangeType VariantInit GetErrorInfo VariantClear SysAllocStringByteLen SysStringLen SysAllocString SysFreeString

generic

count=3, id=199, version=41118,

count=13, id=223, version=20806,

count=261, id=224, version=20806,

count=21, id=225, productName=VS2013 UPD2 build 30501, version=30501,

count=1, id=208, version=65501,

count=49, id=229, version=31101,

count=8, id=225, productName=VS2013 build 21005, version=21005,

count=89, id=225, version=20806,

count=21, id=203, version=65501,

count=221, id=1, productName=Unmarked objects,

count=109, id=109, productName=VS2005 build 50727, version=50727,

count=11, id=125, productName=VS2005 build 50727, version=50727,

count=6, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=119, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,