CapsMouse[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CapsMouse.exe
Size

281KB
MD5

1e85be3567fd817bfba9921c1fbeac2c
SHA1

e711b24ed2f755f63dcfb208e30629391d6b764d
SHA256

ae0ab5dc6b5210913377cccbd3bddbed033906a887ad5fcf00e42699259a5312
SHA512

19db896166b94b66faa3a127d7922462be357170f527199435940753b41416acd4d2676429ecc772814910152049845a71047a276564f1a067af0e6de838587e
SSDEEP

3072:3bqdqh69fxUD23hSZw3pD1/PNZUZT4wRFplrLs:2dqh69fx828cPNZUZTR/lvs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CapsMouse.exe

Files

CapsMouse.exe
.exe windows:6 windows x86 arch:x86

6f60e1128f4899824481087a7162fc47

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyA
CloseHandle
CreateThread
CreateDirectoryA
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
CreateFileA
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
DeleteFileA
Sleep
GetEnvironmentVariableA
FindFirstFileA
GetCurrentThreadId
GetModuleFileNameA

user32

GetMenu
DispatchMessageA
GetMessageA
GetMenuState
DefWindowProcA
keybd_event
GetSubMenu
GetAsyncKeyState
SetWindowsHookExA
MessageBoxA
GetForegroundWindow
PostMessageA
TrackPopupMenu
CreateWindowExA
TranslateMessage
UnhookWindowsHookEx
mouse_event
LoadIconA
CheckMenuItem
RegisterClassA
PostQuitMessage
CallNextHookEx
GetCursorPos
SetCursorPos
SetForegroundWindow

advapi32

RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA

shell32

Shell_NotifyIconA

vcruntime140

__current_exception
__std_exception_destroy
__std_exception_copy
__current_exception_context
_CxxThrowException
_except_handler4_common
memset

api-ms-win-crt-string-l1-1-0

strcat_s

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_crt_atexit
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_seh_filter_exe
_initialize_onexit_table
_set_app_type
_cexit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_initialize_narrow_environment
_configure_narrow_argv
_controlfp_s
exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f60e1128f4899824481087a7162fc47

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 265KB - Virtual size: 265KB

.reloc Size: 1024B - Virtual size: 936B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 265KB - Virtual size: 265KB

.reloc
Size: 1024B - Virtual size: 936B