cafaf1e747e3796278e4675c6bb57b23[.]exe

General

Target
cafaf1e747e3796278e4675c6bb57b23.exe
Size 1.6MB
Sample220131-dtmlhaebhq
SHA256 3c750d7eaa45aea07cd60993c0652ff9fe04b0fee8932e117945191a3fd76914
MD5 cafaf1e747e3796278e4675c6bb57b23
SHA1 4d771f3f714f7df270bea01aca71b7213ebe826a
SHA512 5937d7d96d1d9d1154297abc4ed852be17e61d2eda83d19378e4e99d68ba70930436fd697812959a5833f4d38291b5a37ba74be124cbbaeb549d525803508a51
SSDEEP 24576:nui93Vkg97e2KjCcGIG4W6VifDWIkJ7iJtxNhtNNefd0OIG3RQlyrLxoA8ZPo+Z:dlJe9G3D6JYxpNNEd0OIcRfn0Po+Z1I
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

cafaf1e747e3796278e4675c6bb57b23.exe

.exe 1.6MB

cafaf1e747e3796278e4675c6bb57b23.exe

IMPHASH 23e911f9a82ac0d345fa6cc9104b6bf4
SHA256 3c750d7eaa45aea07cd60993c0652ff9fe04b0fee8932e117945191a3fd76914
MD5 cafaf1e747e3796278e4675c6bb57b23
SHA1 4d771f3f714f7df270bea01aca71b7213ebe826a
SHA512 5937d7d96d1d9d1154297abc4ed852be17e61d2eda83d19378e4e99d68ba70930436fd697812959a5833f4d38291b5a37ba74be124cbbaeb549d525803508a51
SSDEEP 24576:nui93Vkg97e2KjCcGIG4W6VifDWIkJ7iJtxNhtNNefd0OIG3RQlyrLxoA8ZPo+Z:dlJe9G3D6JYxpNNEd0OIcRfn0Po+Z1I
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

687488

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTempPathA GetLastError WinExec lstrlenW FormatMessageW LocalFree AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress CreateFileMappingA LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers GetFileAttributesW FindResourceW LoadResource LockResource FreeResource Sleep GetStringTypeW EncodePointer DecodePointer GetCPInfo SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW CompareStringW LCMapStringW GetLocaleInfoW InitializeSListHead SetEvent ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceFrequency GetCurrentThread GetThreadTimes RtlUnwindEx InterlockedPushEntrySList RtlPcToFileHeader RaiseException LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle GetFileSizeEx SetFilePointerEx GetFileType GetConsoleOutputCP GetConsoleMode GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW OutputDebugStringA SizeofResource RtlUnwind

advapi32

RegCloseKey RegSetValueExW RegOpenKeyExW RegCreateKeyW

shell32

SHGetFolderPathW

winhttp

WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpAddRequestHeaders WinHttpQueryAuthSchemes WinHttpGetProxyForUrl WinHttpSendRequest WinHttpSetCredentials WinHttpConnect WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen WinHttpGetIEProxyConfigForCurrentUser

Name

.text

Size

955KB

Virtual Size

955KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

215KB

Virtual Size

215KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

423KB

Virtual Size

423KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cafaf1e747e3796278e4675c6bb57b23.exe

kernel32

advapi32

shell32

winhttp