caafed26dfeb4690d9d75fc5fe1be906

Sharing

Copy URL Twitter E-mail

General

Target

caafed26dfeb4690d9d75fc5fe1be906
Size

60KB
MD5

caafed26dfeb4690d9d75fc5fe1be906
SHA1

4822ee18445f27c90803fa9474e70bdc6682c113
SHA256

88a314f7dcea2be31623c16616c8c8d19f7ec1822017462af601ba6ba51c1d40
SHA512

c1b812bde4cc0ad3e5d4817fce5953843960f35d654a32dba59c4e07f05d861e1acce0a70a4198fce77521a4b733baf2948647f52de8477677567ea5b9fe7f5e
SSDEEP

768:YWpT8f0CGCo/pPf9Pu98iQaYhhUrtf64pBvevX4fWI+:YmTk0so/pn9Pu9qbUrtf64pM2Wz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
caafed26dfeb4690d9d75fc5fe1be906

Files

caafed26dfeb4690d9d75fc5fe1be906
.dll windows:4 windows x86 arch:x86

b4383743a717e2178b2adcc2e5c00d77

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

urlmon

URLDownloadToFileA

wininet

DeleteUrlCacheEntry

ws2_32

send
recv
closesocket
WSACleanup
connect
htons
socket
WSAStartup
gethostbyname

msvcrt

printf
atoi
strncpy
fopen
fseek
ftell
fgetc
fread
fclose
srand
rand
memcpy
time
memset
strcat
strlen
strcpy
strstr
sprintf

kernel32

GetLastError
LocalAlloc
lstrcmpiA
GetCurrentProcess
OpenProcess
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
CreateRemoteThread
GetVolumeInformationA
GetVersionExA
Sleep
SetSystemTime
GetSystemTime
CloseHandle
GetFileSize
CreateFileA
WinExec
GetFileAttributesA
lstrcatA
lstrcpyA
GetSystemDirectoryA
lstrlenA
CreateThread
CopyFileA
GetWindowsDirectoryA
DeleteFileA
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
FreeLibrary
GlobalAlloc
LoadLibraryA
WriteFile
GetModuleFileNameA
GlobalUnlock
GlobalLock
GetProcAddress

user32

EnumWindows
GetWindowTextA
GetWindow
SendMessageA
wsprintfA
CharUpperA
FindWindowExA
PostMessageA
ShowWindow

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
QueryServiceConfigA
ChangeServiceConfigA
OpenServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegQueryValueExA
RegEnumKeyA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyExA

ole32

CoCreateGuid

shlwapi

PathFileExistsA

Exports

Exports

?Dll1Main@@YGHPAUHINSTANCE__@@KPAX@Z

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4383743a717e2178b2adcc2e5c00d77

Headers

File Characteristics

Imports

urlmon

wininet

ws2_32

msvcrt

kernel32

user32

advapi32

ole32

shlwapi

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 18KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 24KB - Virtual size: 54KB

.rsrc Size: 4KB - Virtual size: 640B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 20KB - Virtual size: 18KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 24KB - Virtual size: 54KB

.rsrc
Size: 4KB - Virtual size: 640B

.reloc
Size: 4KB - Virtual size: 2KB