SUSPICIOUS — amtlib.dll
SUSPICIOUS — amtlib.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (51/100), attributed to the AntiDebug family. 1 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
38f4756b74ec42b46f2cdb7f468355d40653f327e8ebbbb7b9b0ceab4468c494 - SHA-1:
cdd3acd33a21c6e1b08d6b3b3c9acb3bc53066f8 - MD5:
37261f514230f523997e1b354659975e - imphash:
af66b7d26d51f488c25e8e4442eecf15 - ssdeep:
49152:9UpAvB52NiLcafyaC2CJtPp/DhHOw5C2Rubhz:sY6+ctxJb79OrZ - TLSH:
T1595E7C118A137162F1BBB4A4BC5059ECD452B07DB175048DB313C89E81DBE37E6F22AA - Submitted as: amtlib.dll
- File type: pe · Size: 3005576 bytes
- Verdict: suspicious (51/100) · Family: AntiDebug
Detections (1 of 55 engines)
- YARA: Yara-Rules community: YR_AntiDebug_Checks
MITRE ATT&CK
Why this verdict
The suspicious score of 51/100 is the fusion of 3 weighted signals:
- YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://s.symcb.com/pca3-g5.crl0, https://d.symcb.com/rpa0, http://sw.symcb.com/sw.crl0 - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.adobe.com/register
- http://www.adobe.com/go/buy
- http://www.adobe.com/go/denybuy
- http://www.adobe.com/support/
- http://www.w3.org/2001/XMLSchema-instance
- http://standards.iso.org/iso/19770/-2/2008/schema.xsd
- http://s.symcb.com/pca3-g5.crl0
- https://d.symcb.com/rpa0
- http://sw.symcb.com/sw.crl0
- http://sw1.symcb.com/sw.crt0
- http://s.symcb.com/universal-root.crl0
- https://d.symcb.com/rpa0@
- http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
- http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
Embedded domains
- www.adobe.com
- www.w3.org
- standards.iso.org
- regid.1986-12.com
- s.symcb.com
- d.symcb.com
- sw.symcb.com
- sw1.symcb.com
- ts-crl.ws.symantec.com
- ts-aia.ws.symantec.com
Embedded IP addresses
- 3.5.2.0
- 1.0.3.1
Registry keys
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Licensing\UserSpecificLicensing
More AntiDebug samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report