CDNSAR023_2023-01-04_14 43 45[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

CDNSAR023_2023-01-04_14 43 45.zip
Size

2.2MB
MD5

a9ad0c4cebef40014b66a53df635531c
SHA1

d2b3638f8c7e07a97b4bc16ed7f68f82040c64c2
SHA256

e4bfc14f58199334206995a2ab4c25be193b60c49991a636d0a75b34ab8cbfd0
SHA512

f76fc6339d3a1a90c82f0c46e52148ed4dd0e372c534992cf3fddc61806b46b5ac1ca656688d895dd890d64c8073be0f0a8a2332ff4961ab6667a98d8911748c
SSDEEP

49152:tmALsFsjyaPkR8uyVJBReizpb068DHTA/+u6EurvuRFRMlOz55YCrw5EeMkKwNh6:tmJse0kR8Akw7jc+7GFvACM5EXyh6

Score

N/A

Malware Config

Signatures

Files

CDNSAR023_2023-01-04_14 43 45.zip
.zip

Password: SentinelOne1
Device/HarddiskVolume4/windows/CSC/v2.0.6/namespace/srvuprfchc/usersdata$/jedeg/Documents/Cameyo apps/AppName.3427/AppName.3427.cameyo.exe
.exe windows x86

Password: SentinelOne1

fc46741ee1dad2c20e129a2c291e5fae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

wininet

InternetOpenW
InternetOpenUrlW
InternetReadFile
HttpQueryInfoW
InternetGetLastResponseInfoW
InternetCloseHandle

advapi32

RegQueryValueW
GetKernelObjectSecurity
LookupPrivilegeValueA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyW
GetSecurityInfo
RegSetValueExA
GetSidIdentifierAuthority
CryptGenRandom
IsTextUnicode
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
OpenServiceW
RegEnumKeyW
StartServiceW
QueryServiceStatus
ChangeServiceConfigW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegEnumValueW
ConvertSidToStringSidW
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
CryptSetHashParam
CryptGetHashParam
CryptAcquireContextW
CryptReleaseContext
CryptImportKey
CryptCreateHash
CryptDestroyKey
CryptDestroyHash
CryptHashData
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
GetSidSubAuthority
GetUserNameW
RegCreateKeyW
GetTokenInformation
EqualSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
AllocateAndInitializeSid
SetSecurityDescriptorOwner
SetEntriesInAclW
FreeSid
RegSetKeySecurity
GetLengthSid
EnumDependentServicesW
QueryServiceStatusEx
ControlService
RegSaveKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl

oleaut32

SysAllocStringLen
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
OleLoadPicture
OleCreatePictureIndirect
SafeArrayUnaccessData
VariantInit
SafeArrayAccessData
SysFreeString
SysAllocString
VariantClear
VariantChangeType

ole32

CoTaskMemFree
CoCreateGuid
StringFromCLSID
CoInitializeEx
GetHGlobalFromStream
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoCreateInstance

activeds

ord3
ord7

kernel32

RemoveDirectoryW
DeleteFileW
MultiByteToWideChar
CreateProcessW
GetTickCount
GetVersionExW
GetExitCodeProcess
LocalFree
GlobalLock
GlobalUnlock
GlobalFree
GetCurrentProcessId
CreateThread
ConnectNamedPipe
CreateNamedPipeW
ReadFile
DisconnectNamedPipe
lstrcpyW
LocalAlloc
CreateMutexW
SystemTimeToFileTime
FileTimeToSystemTime
ReleaseMutex
FileTimeToLocalFileTime
GetSystemTime
OutputDebugStringW
GetEnvironmentVariableW
SleepEx
SetCurrentDirectoryW
EnumResourceNamesW
GetFileSize
LoadLibraryExW
EndUpdateResourceW
MoveFileW
OpenMutexW
BeginUpdateResourceW
GetCurrentThreadId
GlobalAlloc
MulDiv
ResumeThread
FreeResource
GetCommandLineW
GetProcessIoCounters
GetComputerNameW
GetStdHandle
GetVersion
CompareFileTime
FindFirstFileExW
GetSystemTimeAsFileTime
OpenEventW
GetSystemDirectoryW
GetWindowsDirectoryW
GetLongPathNameW
MapViewOfFile
UnmapViewOfFile
FormatMessageA
WaitNamedPipeW
FormatMessageW
GetModuleFileNameW
FlushFileBuffers
GetTempPathW
GetLocalTime
GetSystemInfo
SetNamedPipeHandleState
UpdateResourceW
EnumResourceLanguagesW
HeapAlloc
HeapFree
GetProcessHeap
TlsGetValue
ProcessIdToSessionId
GetFileSizeEx
FlushViewOfFile
OpenFileMappingW
GetLogicalDrives
QueryDosDeviceW
FindResourceExW
GetFileInformationByHandle
VirtualProtect
LocalUnlock
GetPrivateProfileStringW
WritePrivateProfileStringW
LocalLock
VirtualFree
VirtualAlloc
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
UnhandledExceptionFilter
RtlUnwind
RaiseException
TlsSetValue
TlsFree
TlsAlloc
lstrlenW
lstrlenA
lstrcpyA
lstrcmpA
lstrcatW
WaitForMultipleObjects
VirtualQuery
TerminateThread
ReleaseSemaphore
LoadLibraryExA
LoadLibraryA
GetThreadContext
GetOverlappedResult
GetModuleHandleA
GetModuleFileNameA
GetExitCodeThread
GetCurrentDirectoryW
ExitThread
DuplicateHandle
DeviceIoControl
CreateSemaphoreA
CreateProcessA
CreatePipe
CreateMutexA
CreateFileMappingA
CreateFileA
CreateEventA
CancelIo
GetVersionExA
lstrcmpW
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
InterlockedExchange
CompareStringA
GetLocaleInfoW
ConvertDefaultLocale
GlobalFlags
GlobalReAlloc
GlobalHandle
LocalReAlloc
SetErrorMode
GetStartupInfoW
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
HeapSize
SetHandleCount
GetFileType
HeapCreate
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
LCMapStringA
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
CopyFileW
WriteFile
SetFileAttributesW
FindNextFileW
FreeEnvironmentStringsW
CreateFileMappingW
FindClose
SetFileTime
CreateDirectoryW
GetEnvironmentStringsW
SetEnvironmentVariableW
SetEndOfFile
GetDriveTypeW
SetFilePointer
FindFirstFileW
ExitProcess
Sleep
IsWow64Process
TerminateProcess
OpenProcess
WriteProcessMemory
VirtualProtectEx
ReadProcessMemory
WideCharToMultiByte
DeleteCriticalSection
EnterCriticalSection
SetLastError
SetThreadPriority
CreateFileW
GetFileAttributesW
LeaveCriticalSection
InitializeCriticalSection
GetCurrentThread
CloseHandle
CreateEventW
ResetEvent
GetProcAddress
LoadLibraryW
GetModuleHandleW
SetEvent
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
FreeLibrary
ExpandEnvironmentStringsW
LockResource
GetLastError
SizeofResource
GetCurrentProcess
LoadResource
FindResourceW
WaitForSingleObjectEx

user32

ScreenToClient
EndDialog
UnhookWindowsHookEx
GetMenuItemCount
GetWindowPlacement
IsIconic
SystemParametersInfoA
GetMenu
CallWindowProcW
PtInRect
GetClassInfoW
SetMenu
GetKeyState
MapWindowPoints
GetMessagePos
GetMessageTime
GetForegroundWindow
RemovePropW
GetPropW
SetPropW
GetClassLongW
CallNextHookEx
SetWindowsHookExW
GetCapture
SendDlgItemMessageA
SendDlgItemMessageW
ValidateRect
GetSysColorBrush
UnregisterClassW
GrayStringW
GetWindowTextW
SetWindowTextW
PostQuitMessage
LoadCursorW
RegisterClassExW
LoadIconW
GetDesktopWindow
ShowWindow
MoveWindow
SetTimer
WaitMessage
SystemParametersInfoW
GetNextDlgTabItem
ClientToScreen
SetCursor
FillRect
LoadImageW
GetSubMenu
WindowFromPoint
GetDC
DrawFocusRect
InflateRect
OffsetRect
TrackPopupMenuEx
LoadMenuW
GetWindowLongW
ReleaseDC
DrawStateW
DestroyCursor
GetSysColor
FrameRect
GetActiveWindow
DestroyMenu
DestroyIcon
CopyRect
wvsprintfW
GetWindowRect
GetParent
InvalidateRect
UpdateWindow
FindWindowW
SendMessageW
DestroyWindow
GetMessageW
PostMessageW
MsgWaitForMultipleObjects
MessageBeep
TranslateMessage
PeekMessageW
IsWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
DispatchMessageW
MessageBoxW
GetClientRect
LoadBitmapW
EnableWindow
DrawTextExW
TabbedTextOutW
IsWindowEnabled
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
GetMenuState
CheckMenuItem
CloseDesktop
DispatchMessageA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
PeekMessageA
CloseClipboard
GetSystemMenu
DrawTextW
GetLastActivePopup
DrawIcon
IsDialogMessageW
CreateDialogIndirectParamW
GetAsyncKeyState
EnableMenuItem
EmptyClipboard
GetDlgItem
LoadStringW
CheckDlgButton
OpenClipboard
GetSystemMetrics
SetClipboardData
WinHelpW
GetDialogBaseUnits
EndPaint
BeginPaint
AdjustWindowRectEx
MessageBoxA
GetTopWindow
SetActiveWindow
TrackPopupMenu
RegisterWindowMessageW
GetMenuItemID
RedrawWindow
SetMenuDefaultItem
EnumWindows
AppendMenuW
GetCursorPos
CreatePopupMenu
SendMessageTimeoutW
RemoveMenu
GetWindowThreadProcessId
SetRectEmpty
SetRect
GetClassNameW
IsWindowVisible
GetDlgCtrlID
GetWindow
KillTimer
SetWindowLongW
SetWindowPos
SetForegroundWindow
GetWindowTextLengthW
GetFocus
SetFocus
GetClassInfoExW

gdi32

ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetObjectW
StretchBlt
BitBlt
GetStockObject
GetPixel
CreateCompatibleBitmap
SelectObject
DeleteObject
CreateBitmap
SetPixel
SetBkColor
DeleteDC
SetTextColor
CreateSolidBrush
CreatePen
CreatePatternBrush
CreateRectRgn
CreateFontW
FillRgn
Rectangle
PatBlt
CreateFontIndirectW
GetTextExtentPoint32W
GetDeviceCaps
GetTextMetricsA
GetTextExtentPointA
CreateDCW
SaveDC
RestoreDC
SetBkMode
SetMapMode
GetClipBox
LineTo
MoveToEx
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
CreateCompatibleDC

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

shell32

SHChangeNotify
ShellExecuteW
CommandLineToArgvW
Shell_NotifyIconW
ExtractAssociatedIconW
ShellExecuteExW

comctl32

_TrackMouseEvent
InitCommonControlsEx

shlwapi

SHCopyKeyW
PathFindExtensionW
PathFindFileNameW
PathMatchSpecW

winmm

PlaySoundW

msi

ord173
ord217

oleacc

CreateStdAccessibleObject
LresultFromObject

Sections

CODE
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 869KB - Virtual size: 868KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 278KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 464KB - Virtual size: 463KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
manifest.json

Sharing

General

Malware Config

Signatures

Files

Password: SentinelOne1

Password: SentinelOne1

fc46741ee1dad2c20e129a2c291e5fae

Headers

DLL Characteristics

File Characteristics

Imports

version

wininet

advapi32

oleaut32

ole32

activeds

kernel32

user32

gdi32

winspool.drv

shell32

comctl32

shlwapi

winmm

msi

oleacc

Sections

CODE Size: 120KB - Virtual size: 120KB

.text Size: 869KB - Virtual size: 868KB

.rdata Size: 278KB - Virtual size: 278KB

.data Size: 15KB - Virtual size: 34KB

DATA Size: 5KB - Virtual size: 4KB

BSS Size: 2KB - Virtual size: 1KB

.rsrc Size: 464KB - Virtual size: 463KB

CODE
Size: 120KB - Virtual size: 120KB

.text
Size: 869KB - Virtual size: 868KB

.rdata
Size: 278KB - Virtual size: 278KB

.data
Size: 15KB - Virtual size: 34KB

DATA
Size: 5KB - Virtual size: 4KB

BSS
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 464KB - Virtual size: 463KB