Cames[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Cames.exe
Size

66.1MB
MD5

20b6843e4cdc912a75de13b77b3d3dca
SHA1

ca0fa5bb642913bde26fb2e3391f52032e7c1d46
SHA256

d86c7d5c3c005476948432989f7c8aebf2b831cfc6530d1afc6f7b3bfdac994e
SHA512

1e376f4e69f5157be258c45c9e05ad45085b4b869a352d31377a44de6c01a9b47249797de599380d72e17f5f83de5a61fdf2fc017bc89ab07a49052a87c4d21d
SSDEEP

393216:Bk3cqf0d420KGSFqsfr2eKquQqP8G4Nk4F5SP4PV8IAKlGDM7ijJe9vMm2:uKNqsr2eKquQ/H04PkDM7QI4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Cames.exe

Files

Cames.exe
.exe windows:5 windows x86

Password: 6yhtyhtth

d157bd4ca4ebd3158e3f3a5009c4b935

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

wininet

InternetOpenW
InternetOpenUrlW
InternetReadFile
HttpQueryInfoW
InternetGetLastResponseInfoW
InternetCloseHandle

advapi32

RegQueryValueW
GetKernelObjectSecurity
LookupPrivilegeValueA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyW
GetSecurityInfo
RegSetValueExA
GetSidIdentifierAuthority
CryptGenRandom
IsTextUnicode
GetSecurityDescriptorSacl
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
OpenServiceW
RegEnumKeyW
StartServiceW
QueryServiceStatus
ChangeServiceConfigW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegEnumValueW
ConvertSidToStringSidW
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
CryptSetHashParam
CryptGetHashParam
CryptAcquireContextW
CryptReleaseContext
CryptImportKey
CryptCreateHash
CryptDestroyKey
CryptDestroyHash
CryptHashData
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
GetSidSubAuthority
GetUserNameW
RegCreateKeyW
GetTokenInformation
EqualSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
AllocateAndInitializeSid
SetSecurityDescriptorOwner
SetEntriesInAclW
FreeSid
RegSetKeySecurity
GetLengthSid
EnumDependentServicesW
QueryServiceStatusEx
ControlService
RegSaveKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo

oleaut32

SysAllocStringLen
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
OleLoadPicture
OleCreatePictureIndirect
SafeArrayUnaccessData
VariantInit
SafeArrayAccessData
SysFreeString
SysAllocString
VariantClear
VariantChangeType

ole32

CoTaskMemFree
CoCreateGuid
StringFromCLSID
CoInitializeEx
GetHGlobalFromStream
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoCreateInstance

activeds

ord3
ord7

kernel32

RemoveDirectoryW
DeleteFileW
MultiByteToWideChar
CreateProcessW
GetTickCount
GetVersionExW
GetExitCodeProcess
LocalFree
GlobalLock
GlobalUnlock
GlobalFree
GetCurrentProcessId
CreateThread
ConnectNamedPipe
CreateNamedPipeW
ReadFile
DisconnectNamedPipe
lstrcpyW
LocalAlloc
CreateMutexW
SystemTimeToFileTime
FileTimeToSystemTime
ReleaseMutex
FileTimeToLocalFileTime
GetSystemTime
OutputDebugStringW
GetEnvironmentVariableW
SleepEx
SetCurrentDirectoryW
EnumResourceNamesW
GetFileSize
LoadLibraryExW
EndUpdateResourceW
WaitForSingleObjectEx
OpenMutexW
BeginUpdateResourceW
MoveFileW
GlobalAlloc
MulDiv
ResumeThread
FreeResource
GetCommandLineW
GetProcessIoCounters
GetComputerNameW
GetStdHandle
GetVersion
CompareFileTime
FindFirstFileExW
GetSystemTimeAsFileTime
OpenEventW
GetSystemDirectoryW
GetWindowsDirectoryW
GetLongPathNameW
MapViewOfFile
UnmapViewOfFile
FormatMessageA
WaitNamedPipeW
FormatMessageW
GetModuleFileNameW
FlushFileBuffers
GetTempPathW
GetLocalTime
GetSystemInfo
SetNamedPipeHandleState
UpdateResourceW
EnumResourceLanguagesW
HeapAlloc
HeapFree
GetProcessHeap
TlsGetValue
GetFileSizeEx
FlushViewOfFile
OpenFileMappingW
GetLogicalDrives
QueryDosDeviceW
FindResourceExW
GetFileInformationByHandle
VirtualProtect
LocalUnlock
GetPrivateProfileStringW
WritePrivateProfileStringW
LocalLock
VirtualFree
VirtualAlloc
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
UnhandledExceptionFilter
RtlUnwind
RaiseException
TlsSetValue
TlsFree
TlsAlloc
lstrlenW
lstrlenA
lstrcpyA
lstrcmpiA
lstrcmpA
lstrcatW
WaitForMultipleObjects
VirtualQuery
TerminateThread
ReleaseSemaphore
OpenMutexA
OpenFileMappingA
OpenEventA
LoadLibraryExA
LoadLibraryA
GetThreadContext
GetSystemDirectoryA
GetModuleHandleA
GetModuleFileNameA
GetFileAttributesA
GetExitCodeThread
GetCurrentDirectoryW
GetCurrentDirectoryA
InterlockedExchange
ExitThread
DuplicateHandle
DeviceIoControl
CreateSemaphoreA
CreateProcessA
CreatePipe
CreateMutexA
CreateFileMappingA
CreateFileA
CreateEventA
GetVersionExA
lstrcmpW
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
CompareStringA
GetLocaleInfoW
ConvertDefaultLocale
GlobalFlags
GlobalReAlloc
GlobalHandle
LocalReAlloc
SetErrorMode
GetStartupInfoW
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
HeapSize
SetHandleCount
GetFileType
HeapCreate
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
LCMapStringA
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
CopyFileW
WriteFile
SetFileAttributesW
FindNextFileW
FreeEnvironmentStringsW
CreateFileMappingW
FindClose
SetFileTime
CreateDirectoryW
GetEnvironmentStringsW
SetEnvironmentVariableW
SetEndOfFile
GetDriveTypeW
SetFilePointer
FindFirstFileW
ExitProcess
Sleep
IsWow64Process
TerminateProcess
OpenProcess
WriteProcessMemory
VirtualProtectEx
ReadProcessMemory
WideCharToMultiByte
VirtualQueryEx
DeleteCriticalSection
EnterCriticalSection
SetLastError
SetThreadPriority
CreateFileW
GetFileAttributesW
LeaveCriticalSection
InitializeCriticalSection
GetCurrentThread
CloseHandle
CreateEventW
ResetEvent
GetProcAddress
LoadLibraryW
GetModuleHandleW
SetEvent
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
FreeLibrary
ExpandEnvironmentStringsW
LockResource
GetLastError
SizeofResource
GetCurrentProcess
LoadResource
FindResourceW
GetCurrentThreadId

user32

GrayStringW
ScreenToClient
EndDialog
UnhookWindowsHookEx
GetMenuItemCount
GetWindowPlacement
IsIconic
SystemParametersInfoA
GetMenu
CallWindowProcW
PtInRect
GetClassInfoW
SetMenu
GetKeyState
MapWindowPoints
GetMessagePos
GetMessageTime
GetForegroundWindow
RemovePropW
GetPropW
SetPropW
GetClassLongW
CallNextHookEx
SetWindowsHookExW
GetCapture
SendDlgItemMessageA
SendDlgItemMessageW
ValidateRect
GetSysColorBrush
UnregisterClassW
DrawTextExW
GetWindowTextW
SetWindowTextW
PostQuitMessage
LoadCursorW
RegisterClassExW
LoadIconW
GetDesktopWindow
ShowWindow
MoveWindow
SetTimer
WaitMessage
SystemParametersInfoW
GetNextDlgTabItem
ClientToScreen
SetCursor
FillRect
LoadImageW
GetSubMenu
WindowFromPoint
GetDC
DrawFocusRect
InflateRect
OffsetRect
TrackPopupMenuEx
LoadMenuW
GetWindowLongW
ReleaseDC
DrawStateW
DestroyCursor
GetSysColor
FrameRect
GetActiveWindow
DestroyMenu
DestroyIcon
CopyRect
wvsprintfW
GetWindowRect
GetParent
InvalidateRect
UpdateWindow
FindWindowW
SendMessageW
DestroyWindow
GetMessageW
PostMessageW
MsgWaitForMultipleObjects
MessageBeep
TranslateMessage
PeekMessageW
IsWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
DispatchMessageW
MessageBoxW
GetClientRect
LoadBitmapW
EnableWindow
TabbedTextOutW
IsWindowEnabled
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
GetMenuState
CheckMenuItem
CloseDesktop
DispatchMessageA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
PeekMessageA
GetKeyboardType
CloseClipboard
GetSystemMenu
DrawTextW
GetLastActivePopup
DrawIcon
IsDialogMessageW
CreateDialogIndirectParamW
GetAsyncKeyState
EnableMenuItem
EmptyClipboard
GetDlgItem
LoadStringW
CheckDlgButton
OpenClipboard
GetSystemMetrics
SetClipboardData
WinHelpW
GetDialogBaseUnits
EndPaint
BeginPaint
AdjustWindowRectEx
MessageBoxA
GetTopWindow
SetActiveWindow
TrackPopupMenu
RegisterWindowMessageW
GetMenuItemID
RedrawWindow
SetMenuDefaultItem
EnumWindows
AppendMenuW
GetCursorPos
CreatePopupMenu
SendMessageTimeoutW
RemoveMenu
GetWindowThreadProcessId
SetRectEmpty
SetRect
GetClassNameW
IsWindowVisible
GetDlgCtrlID
GetWindow
KillTimer
SetWindowLongW
SetWindowPos
SetForegroundWindow
GetWindowTextLengthW
GetFocus
SetFocus
GetClassInfoExW

gdi32

ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetObjectW
StretchBlt
BitBlt
GetStockObject
GetPixel
CreateCompatibleBitmap
SelectObject
DeleteObject
CreateBitmap
SetPixel
SetBkColor
DeleteDC
SetTextColor
CreateSolidBrush
CreatePen
CreatePatternBrush
CreateRectRgn
CreateFontW
FillRgn
Rectangle
PatBlt
CreateFontIndirectW
GetTextExtentPoint32W
GetDeviceCaps
GetTextMetricsA
GetTextExtentPointA
CreateDCW
SaveDC
RestoreDC
SetBkMode
SetMapMode
GetClipBox
LineTo
MoveToEx
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
CreateCompatibleDC

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

shell32

SHChangeNotify
ShellExecuteW
CommandLineToArgvW
Shell_NotifyIconW
ExtractAssociatedIconW
ShellExecuteExW

comctl32

_TrackMouseEvent
InitCommonControlsEx

shlwapi

SHCopyKeyW
PathFindExtensionW
PathFindFileNameW
PathMatchSpecW

winmm

PlaySoundW

msi

ord173
ord217

oleacc

CreateStdAccessibleObject
LresultFromObject

Sections

CODE
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 856KB - Virtual size: 856KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 273KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 595KB - Virtual size: 594KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 6yhtyhtth

d157bd4ca4ebd3158e3f3a5009c4b935

Headers

DLL Characteristics

File Characteristics

Imports

version

wininet

advapi32

oleaut32

ole32

activeds

kernel32

user32

gdi32

winspool.drv

shell32

comctl32

shlwapi

winmm

msi

oleacc

Sections

CODE Size: 132KB - Virtual size: 131KB

.text Size: 856KB - Virtual size: 856KB

.rdata Size: 273KB - Virtual size: 272KB

.data Size: 15KB - Virtual size: 34KB

DATA Size: 5KB - Virtual size: 5KB

BSS Size: 2KB - Virtual size: 1KB

.rsrc Size: 595KB - Virtual size: 594KB

CODE
Size: 132KB - Virtual size: 131KB

.text
Size: 856KB - Virtual size: 856KB

.rdata
Size: 273KB - Virtual size: 272KB

.data
Size: 15KB - Virtual size: 34KB

DATA
Size: 5KB - Virtual size: 5KB

BSS
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 595KB - Virtual size: 594KB