Windows Analysis Report
AMFWReset.exe_

ID:	1562584
Product:	CloudBasic
Start time:	18:26:55
Start date:	25.11.2024
Sample:	AMFWReset.exe_
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	bcbf521304a3f6513072c640a99d9f01
SHA1:	1b542b20e95350735cdd8985dc3eca52eede751e
SHA256:	65e932a660d5b123fb20131605beb94a1b77ed7d922c6c9fddcef8640e1e45ca
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256

Compliance

Source: AMFWReset.exe_

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: AMFWReset.exe_

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

System Summary

Source: AMFWReset.exe_

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: clean1.winEXE_@1/0@0/0

Source: AMFWReset.exe_

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\AMFWReset.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\AMFWReset.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\AMFWReset.exe	Section loaded: amfwusers.dll
Source: C:\Users\user\Desktop\AMFWReset.exe	Section loaded: mfcext.dll
Source: C:\Users\user\Desktop\AMFWReset.exe	Section loaded: fwdbcore.dll
Source: C:\Users\user\Desktop\AMFWReset.exe	Section loaded: mfc140.dll
Source: C:\Users\user\Desktop\AMFWReset.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Desktop\AMFWReset.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Desktop\AMFWReset.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Desktop\AMFWReset.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\AMFWReset.exe	Section loaded: vcruntime140.dll

Source: AMFWReset.exe_

Static file information: File size 20915712 > 1048576

Source: AMFWReset.exe_

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x13e6800

Source: AMFWReset.exe_	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: AMFWReset.exe_	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: AMFWReset.exe_	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: AMFWReset.exe_	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: AMFWReset.exe_	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: AMFWReset.exe_	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: AMFWReset.exe_

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: AMFWReset.exe_

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: AMFWReset.exe_	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: AMFWReset.exe_	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: AMFWReset.exe_	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: AMFWReset.exe_	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: AMFWReset.exe_	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Malware Analysis System Evasion

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected