amatled_0[.]0[.]14_windows_amd64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
amatled_0.0.14_windows_amd64.zip
Size 9.7MB
Sample261107-vba87aet7j
SHA256 abacc2fdf9cb2c06730e21e1ac9355ebd4d46699949df61831be0754b51acc82
MD5 fef2f5e82bb5435d04f8d951b9e855ad
SHA1 238ad630170716b9fc9245725ac8e912e6e66ca8
SHA512 d88a2208a25337eaf30acecf690d51affb0e9062149ca6979dcf5c3328557ef6daeb1d124d8c8894fc206e27b54148af041ddb1134b61a06212f13b12dec62ce
SSDEEP 196608:/pSrnCclSbfM53wRHn5F1+9q7mIY2sb5Cmw2DmU3oKlk5sl5tXB2SEtZeH5bWLcM:8r3lV3sHn5FFplU5CmXX3oKlk5sJX8pZ
TLSH
T154A633A9E0F8ED3D4E0749CFA34BDE2185BCF1EDAF33882491944688167B9BF4805675
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/amatled.exe

File Explorer

amatled_0.0.14_windows_amd64.zip

.zip 9.7MB
README.md

2KB
amatled.exe

.exe 29.2MB

amatled_0.0.14_windows_amd64.zip

SHA256 abacc2fdf9cb2c06730e21e1ac9355ebd4d46699949df61831be0754b51acc82
MD5 fef2f5e82bb5435d04f8d951b9e855ad
SHA1 238ad630170716b9fc9245725ac8e912e6e66ca8
SHA512 d88a2208a25337eaf30acecf690d51affb0e9062149ca6979dcf5c3328557ef6daeb1d124d8c8894fc206e27b54148af041ddb1134b61a06212f13b12dec62ce
SSDEEP 196608:/pSrnCclSbfM53wRHn5F1+9q7mIY2sb5Cmw2DmU3oKlk5sl5tXB2SEtZeH5bWLcM:8r3lV3sHn5FFplU5CmXX3oKlk5sJX8pZ
TLSH
T154A633A9E0F8ED3D4E0749CFA34BDE2185BCF1EDAF33882491944688167B9BF4805675
MD5 SHA1 SHA512 SSDEEP TLSH

amatled.exe

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 5399eb989774ea0c14eb453481f030838cdd0f56a888fd8cdbc2ca7f931677fd
MD5 33742415146eef97f8b19e9ae5a039d2
SHA1 24c683100c9093550750b69619af4b47b0b43186
SHA512 65e69b710188796ab6cd924acba26feaa54b3e167a2d9c258653aaa769f419a3d9ad9f59542df2424eb9915d180542b5804b13b05cb1e88f44499d2dcc52c25d
SSDEEP 196608:i3V0GPRHSN7J3vkyMfHJRo8aDb0oKXUykA+wyrGpBPtTUVE:iF0GJH47JcjHJRy/0FZtT
TLSH
T174675C43E8A148EAC9A9CA34C5218523BF317C468F2017D73B68F6646F76BD06E7B750
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

529824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

10.7MB

Virtual Size

10.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17.2MB

Virtual Size

17.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

687KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

270KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

amatled_0.0.14_windows_amd64.zip

README.md

amatled.exe

kernel32

generic