oCam v520[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

oCam v520.exe
Size

8.7MB
MD5

1cd74e3112058ee572632954abbd34b9
SHA1

ab7b4d17116adb17b360156243f34a9bc83469b6
SHA256

fd88c998132c814adb953e01400d5979c60dfe72e722eb2659f266eb9593f430
SHA512

1bdfa80400054a8efd579755d4330df3e27d151751a5746a397b1b5677b9779edca4ef402dd30edc094b2f12483b6d307d94a8a56c2e9e83834f998e179710a6
SSDEEP

196608:Acg49OgsSsDinxi3ctRmbltQVZMdtkzuin/iabPtO5xFKOXqJ4RZsHjS:AqnIsvYltQVzv6x5xpqbm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
oCam v520.exe

Files

oCam v520.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

LoadEnvi
MemoryCompare
MemoryCopy
MemorySet
WndProc1
WndProc1_
WndProc2
WndProc2_
WndProc3
WndProc3_

Sections

.text
Size: 659KB - Virtual size: 659KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

flag_dat
Size: 512B - Virtual size: 19B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 507KB - Virtual size: 506KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ