home

ams43.exe

The program is a setup application that uses the Wise Installer installer. The file has been seen being downloaded from mg.mail.yahoo.com and multiple other hosts.
MD5:
53677fd79eef5ea94d99aaa470309d05

SHA-1:
51277d18e2d5565fcac9f2ba186910e477cfc998

SHA-256:
970fdfe45d048b06944161bbeb2ac56684819c6e3fcacbc3b45b72c47c25fff9

Scanner detections:
6 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
5/8/2024 7:08:43 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:MassMail-A [PUP]
2014.9-140319

Bkav FE
W32.Clod0ed.Trojan
1.3.0.4959

Comodo Security
UnclassifiedMalware
17896

Dr.Web
Tool.MassMail.2
9.0.1.078

Norman
Suspicious_Gen4.ECZFV
11.20140319

Sophos
Advanced Mass Sender
4.98

File size:
3.7 MB (3,919,332 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Wise Installer

Language:
English (United States)

File PE Metadata
Compilation timestamp:
4/25/2000 3:37:12 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:0w2syfcEVDAAhnzVvY0NsS7vCkDRCoDi7Y7T8KeAf:Z2sCkU1Y0NsSDdDR9DiMfbf

Entry address:
0x21AF

Entry point:
55, 8B, EC, 81, EC, 2C, 05, 00, 00, 53, 56, 57, 6A, 01, 5E, 6A, 04, 89, 75, E8, FF, 15, 54, 40, 40, 00, FF, 15, 50, 40, 40, 00, 8B, F8, 89, 7D, F4, 8A, 07, 3C, 22, 0F, 85, 90, 00, 00, 00, 8A, 47, 01, 47, 89, 7D, F4, 33, DB, 3A, C3, 74, 0D, 3C, 22, 74, 09, 8A, 47, 01, 47, 89, 7D, F4, EB, EF, 80, 3F, 22, 75, 04, 47, 89, 7D, F4, 80, 3F, 20, 75, 09, 47, 80, 3F, 20, 74, FA, 89, 7D, F4, 53, FF, 15, 6C, 40, 40, 00, 80, 3F, 2F, 89, 45, F8, 75, 28, 8A, 47, 01, 3C, 53, 74, 04, 3C, 73, 75, 06, 89, 35, 58, 53, 40, 00...
 
[+]

Entropy:
7.9998

Packer / compiler:
Wise Installer Stub

Code size:
8.5 KB (8,704 bytes)

The file ams43.exe has been seen being distributed by the following 19 URLs.

https://mg.mail.yahoo.com/ya/.../zXgD6ABxKMkQ&fid=Inbox&pid=2&clean=0&appid=YahooMailBasic

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-ok6XiHVHPhRCf6D9byzlIet-RoRjjOT94i3lbVICqYq5PDv50nxzim8W0V1wF0VqOhlIgOsK-VEEKqVdp3kLGg/messages/@.id==AFhn-FcAAChaT4G_Jgf3oDIbE1U/content/parts/@.id==2/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBZUeAhQcJEVuIb3g7pMJ2skS58S_2qtd16-WI49c6P4qZc20flCo9m7HJ2jgw-YYh_seJ7WG4KthVAfG5zOXx10&error=https://uk-mg42.mail.yahoo.com/.../iframemsg?id=80dfcf77-11b2-0467-d2fd-4d9c41fc9ff6&ymreqid=3dc15657-a16d-756e-01aa-4f0098010000

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-8sFGPBy9s6-xF4utk-xJnLf8DDwD5p73SrP6ZWuXm0ZaSERHsnUxpwhBGl38JIri-OZtZrw2rULBXQ-scIJXZQ/messages/@.id==AIuti2IAAZnHVv0fMQdHSAJmcKE/content/parts/@.id==2/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBbxZutjGPkepZCGlVnCscDuy5T-VFaKg9q-rZWmPboYMA&error=https://us-mg6.mail.yahoo.com/.../iframemsg?id=b8746ce7-5b60-85bb-f630-4eaf64d538c5&ymreqid=0e9477f3-786a-ed72-01f3-5e0372010000

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-avrx5ZHxlC87X40I-yENj4QvFp8EL67b3ypDJ_wK5rB7pRWw5pVt-qTsD7Q0Vlg0yqtsdt-jko-uK0ko8KHOrw/messages/@.id==AEx3w0MAHlBDV-PKjwkvkFtI-14/content/parts/@.id==2/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBYEYjaE8DDQKI1yosaKzfM291FeHbUMkwn6RC8A9NE2_9uQo2F3YT7N-2SK6jRZXt7oXrvqWXAmKM0cYz1HHvee&error=https://mg.mail.yahoo.com/.../iframemsg?id=364feb17-3b4e-5b18-b0e3-63fc4a9c1fbc&ymreqid=e93013f6-3b6d-591f-01a0-5f000f010000

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-DxTaCpNA9nUCGp43JamQVUr3WDu6fanQp05WH_yrAsHVgcNq_6T4vFCh63ddfMYI/messages/@.id==AI--imIAACTTVWg_WQhQ6KShURQ/content/parts/@.id==2/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBZ6UqDYzg3YSXBT1eJ8NS456F676llwJijNHGM9Rx73ng&error=https://us-mg5.mail.yahoo.com/.../iframemsg?id=a7aaba22-78f6-6fa7-5f6a-bb77ce1dfa14&ymreqid=03c55c53-b0f1-f40b-01e9-d60039010000

temp:AMS43.exe

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-oZohunDRxY0vqItfTaJDJhJ4SVoqWuzM_rFxpfrqV4W1lPNeG6YvgQmoiOaiKAhGyqtsdt-jko-uK0ko8KHOrw/messages/@.id==AC_kimIAABD8VCWPS_C9wEnLu3E/content/parts/@.id==3/raw?appid=YahooMailNeo&ymreqid=ab73f43d-9f3a-62fd-0171-680027010000&token=Xji2J4cscT63cVxFZ3PrF_h04w8WJZSWFztGRYltuj3ofJyptA560fBnijCn8kNsmMhGeHwcT_UQFHgYhMO2HQ&error=https://us-mg5.mail.yahoo.com/.../iframemsg?id=976123ba-8aaa-6ea4-f327-2c800573a288

https://mg.mail.yahoo.com/ya/.../mjkQAAV7nVuCV Q7sULfYsko&fid=Sent&pid=2&clean=0&appid=YahooMailBasic

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_2_135394_AC3sw0MAABeLUskvpcL3ALICz3w&fid=Sent&pid=2.2.2.2.2.2.2&clean=0&appid=YahooMailNeo&ymreqid=4770a371-ad71-fdde-0189-d90014010000

http://www.californiavtxriders.com/AMS43.exe

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_1_21813_ACIJDNkAABFaVW8iPwh74LeEaX4&fid=Inbox&pid=2&clean=0&appid=YahooMailBasic

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-yNbyGQRO78ZxUJ_X6p-gWVD1qgWRGs2AX0HT_MHW1PMyrsV5DB70nI0n4BgFsy-0/messages/@.id==APhVimIAAKjPUL4h_w7WsloMO3k/content/parts/@.id==2/raw?appid=YahooMailNeo&ymreqid=c5cf9e46-e009-79c7-01b9-f2009d010000&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBZxUsCeaZu5UQqyEsq7_Bfv6F676llwJijNHGM9Rx73ng&error=https://us-mg5.mail.yahoo.com/.../iframemsg?id=840ea7e5-0383-827a-a236-b7e25bbc93c3

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-4JCQV1w6z7J0RQS38XlknImBL_xVU_5bwe-nDlC3viOze_7NCdWiRLr6yiCMd-l6GH4nkLovJSeSm65J69qU1w/messages/@.id==AMFVimIAAMXoTWaDGQVOJwMj1os/content/parts/@.id==2/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBZvEFE2cZi_9XLG7D1ETZZE_tmbZU_QP6bd5QzJLzvu9w&error=https://us-mg6.mail.yahoo.com/.../iframemsg?id=a1c87601-06f0-a9fb-19c7-baaa29bf7168&ymreqid=be045f5f-1405-3d67-011b-710049010000

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_1_59832_AJl2imIAABISVD 9NwYmOJ133Eg&fid=Inbox&pid=2.2&clean=0&appid=YahooMailNeo

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_1_1872815_ANhVfbwAABrwVrxChAn mLwPSro&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo&ymreqid=0102c727-ae99-c948-01a1-db0009010000

https://ne1-attach.ymail.com/internal.dl-mail.ymail.com/ws/download/mailboxes/@.id==MTE1MjE5NzU1MCAxMjIyMDYgMTIyMiBta29mZmkxOUB5YWhvby5jb20/messages/@.id==AMy_imIAAA9uU3x96wAAADmNwUE/content/parts/.../raw?appid=YahooMailBasic&token=GnurPzuJKfsNQ3ezuF375Xxl8dT2-Cym0peYuKozbavYc5XJVZEGemV4s_jS-Ghw6F676llwJijNHGM9Rx73ng&ymreqid=cecfe390-4020-11e5-c000-6f41ca5f9c25

http://server00.send6.com/.../AMS43.exe

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-Zam6aR3Q8U7vOvWsh8mezCS1uCLx4JEWQCzcqB6xYnz5AWysiFaYBeEmC9o39nam/messages/@.id==AOlJyAoAACxTVsXRPQw1AAMiQ04/content/parts/@.id==2/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBanQOifTdNG5JaNiJIrqlOm6F676llwJijNHGM9Rx73ng&error=https://uk-mg42.mail.yahoo.com/.../iframemsg?id=b044c64c-92bd-e5bf-c8d5-1cb64e3df753&ymreqid=28bcba3c-393b-decd-0160-7b005d010000

https://ne1-attach.ymail.com/internal.dl-mail.ymail.com/ws/download/mailboxes/@.id==MTM4MDMxMzI4MSAxODEyNjAgMTgxMiByaWNreTcwNzB1QHlhaG9vLmNvbQ/messages/@.id==AJUPw0MAAIyMTmeAtgIT0AiXWps/content/parts/.../raw?appid=YahooMailBasic&token=a225dl9wOfR6_Sl4uQUy9YTbv3heqXkQabVj0lvGEcoLKOCMwONycKsXUdFVvWrD4QS589m2ULn4HOf3kMCF_g&ymreqid=1390cdd0-8236-11e5-c000-9b1f557fc515

Scan ams43.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.