CW_CAMOS[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

CW_CAMOS.exe
Size

17KB
MD5

99611ed9534ab4e8acde99bcb9212185
SHA1

483f84aaa940bce5727b268c7bb368e42bbd3415
SHA256

120eed48b9e1079b44886adbf6727ccc9efc1e5e64f58d94910eac1c3bd8ee10
SHA512

b53b3230617ddcf0faeb6838baa8f16be7a0f184ac8a492a399ac73be632c54329d5d05ca103be67b43ce470e699ed1723c93828f0c823ae7af03a022aacee48
SSDEEP

384:mLN+i++xLn6YujTexFnekRv3p5OfO3a6ptYcFwVc03K:wgG6GFP3b7ntYcFwVc6K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CW_CAMOS.exe

Files

CW_CAMOS.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\akorn\Desktop\CW-PAP-Tool-main\CWHelper\MemClass\obj\Debug\MemClass.pdb

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ